151.240.93.142📋 Copy

# IP Intelligence Briefing: 151.240.93.142

## Executive Summary

IP address 151.240.93.142 presents a mixed threat profile with a current low-risk rating (25/100) but historical indicators of malicious activity. The IP is geolocated to Boston, MA, US, though historical data shows conflicting Iran-based geolocation signals. The address currently exhibits no open services and is firewalled, but remains listed on one DNSBL feed out of eight total.

## Current Profile Assessment

• Risk Score: 25 (Low Risk)
• Control Plane: Origin ASN 137409, BGP prefix 151.240.93.0/24
• Operator Score: 0.1304 (Minimal)
• Route Stability: 0 route changes in 30 days, marked as not stable
• DNSBL Status: Listed on 1 of 8 threat feeds
• Services: No open ports detected (Firewalled / No Services)
• Network Classification: Not identified as CDN, proxy, VPN, Tor, or hosting provider
• Geolocation: US (MA, Boston) - single consensus source

## Historical Threat Indicators

Nine signal observations recorded, with the most recent activity on 2026-07-18:

• Geolocation Conflict: Historical signal indicates Iran (IR) coordinates with 75% confidence, conflicting with current US geolocation
• Threat Indicators: Associated with threat pulses; one high-severity listing detected
• Operator Score: 0.15 (Minimal)
• DNSSEC: Valid (true)
• Listings: Multiple DNSBL categories including high-severity classifications

## Neighborhood Analysis

The /24 subnet (151.240.93.0/24) contains 55 neighboring IPs:

• Abuse Density: 0
• Risk Distribution: All 55 neighbors classified as low risk
• Threat Siblings: 0
• Notable Neighbors: 151.240.93.10 shows a risk score of 25 (same as subject IP)

## Relationship Graph

No relationships detected in the relationship graph (0 entries). No associated hostnames, organizations, certificates, or subnets identified.

## Behavioral Indicators

• Honeypot Hits: 0
• Enumeration Strikes: 0
• WAF Violations: 0
• Active Attacker Status: False
• Auto-Banned: False
• Total Incidents: 0

## Recommended Actions

Based on the mixed threat profile:

1. Monitor Closely: Despite low current risk score, historical Iran-based threat indicators warrant ongoing observation

2. Block DNSBL Listing: IP is listed on one threat feed; consider blocking based on organizational policy

3. Traffic Analysis: No services detected currently; monitor for future service opening

4. Subnet Context: Clean neighborhood (0 high/medium risk IPs) suggests isolated risk rather than compromised subnet

## Intelligence Narrative

The IP 151.240.93.142 demonstrates characteristics of a previously compromised or monitored address. Recent historical signals show Iran-based geolocation with threat associations and high-severity DNSBL listings, suggesting past malicious activity. The current low-risk profile and absence of open services may indicate the address is now dormant or has been remediated. However, the conflicting geolocation data (US vs. IR) and persistent DNSBL listing warrant continued monitoring. The subnet appears clean with no elevated risk neighbors, suggesting this is an isolated incident rather than part of a larger campaign.

Threat Level: LOW (with historical HIGH indicators)

Recommended Handling: Monitor for service reactivation and DNSBL de-listing

---

*Report generated via IPDebrief intelligence tools. Data reflects current and historical observations as of report generation.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.