149.28.232.89📋 Copy

# IP INTELLIGENCE BRIEFING

Target IP: 149.28.232.89/32

Classification: Low Risk Infrastructure Asset

Date of Analysis: 2026-06-19

---

## EXECUTIVE SUMMARY

IP 149.28.232.89 is a low-risk cloud computing infrastructure address operated by Vultr Holdings, LLC (ASN 20473). The IP presents minimal threat characteristics with no active malicious indicators, blacklist presence, or attack campaign associations. The address operates as a firewalled cloud host with no open services detected.

---

## INFRASTRUCTURE PROFILE

Control Plane Data:

• BGP Prefix: 149.28.224.0/20
• Route Stability: False
• DNSBL Listed: 1 of 8 lists
• Operator Score: 0.1304 (Minimal)

---

## THREAT ASSESSMENT

Threat Indicators: None detected

• Not a Tor exit node
• Not a known attacker
• Not a spam source
• Blacklist count: 0
• No known campaign associations

Network Classification:

• Infrastructure Type: CloudCompute
• Hosting Service: Yes
• Proxy/VPN: No
• CDN: No
• Anycast: No
• Bogon: No

---

## OBSERVATION HISTORY

Signal History (23 observations):

• Most recent observation: 2026-06-19T12:46:48 UTC
• Risk assessment trend: Consistent "Minimal" classification
• Network role stability: Maintained as Vultr cloud infrastructure
• No persistent malicious behavior detected

Temporal Analysis:

• Ownership changes: 0
• Threat persistence days: 0
• Threat observation count: 1
• Persistently malicious: False

---

## GEOLOCATION ANALYSIS

Reported Location: US, New Jersey, Piscataway

Validation Status: ⚠️ GEOLOCATION DISCREPANCY DETECTED

• geoPlausible: False
• Distance violation: 6,009 km reported vs. 25,000 km accuracy radius
• RTT violation: 23ms observed vs. minimum possible 120.2ms for reported distance
• Minimum RTT observed: 23ms

Implication: Reported geolocation appears inconsistent with network measurements. Actual origin location may differ from reported NJ/Piscataway coordinates.

---

## NEIGHBORHOOD ANALYSIS

Subnet: 149.28.232.0/24

Abuse Density: 0 (Clean)

Classification: mostly_clean

Threat Siblings: 0

Total Siblings: 1 active

The immediate /24 subnet shows no malicious activity. This IP is isolated from neighboring abuse indicators.

---

## RELATIONSHIP MAPPING

Relationships Identified: 38

• Primary associations: Same network (NET-149-28-232-0-23)
• Network relationships indicate clustering within Vultr's 149.28.0.0/16 allocation

---

## SERVICE ANALYSIS

Open Ports: None detected

TLS Certificates: None

HTTP Service: None (Firewalled / No Services)

Banner Detection: No response data available

---

## RECOMMENDATIONS

Security Actions: No immediate actions required

• Risk profile indicates legitimate cloud infrastructure
• No firewall rules necessary based on current threat indicators
• No blocking or rate-limiting recommendations

Monitoring Guidance:

• Monitor for service activation if this IP transitions from "Firewalled / No Services" state
• Track geolocation consistency if operational location changes
• Consider geo-validation in security tooling due to RTT/location discrepancy

---

## INTELLIGENCE CONCLUSION

IP 149.28.232.89 represents standard Vultr cloud infrastructure with no observed malicious activity. The IP is suitable for normal network operations but should be monitored for service activation. The geolocation discrepancy warrants awareness but does not indicate malicious behavior. No immediate defensive actions are required.

Confidence Level: High

Threat Classification: Low Risk

Action Required: None

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.