167.249.140.90📋 Copy

IP Intelligence Briefing: 167.249.140.90

Date: 2026-06-05

---

**1. Core Profile**

• Risk Score: Moderate (55/100)
• Ownership: Registered to Sapucaia Comercio e informatica ltda - me (AS265191) in Brazil (RJ).
• Geolocation: Sapucaia, Rio de Janeiro, Brazil (geoplatform consensus).
• Network Role: Single-service host (SSH on port 22 via Dropbear).
• Threat Status: No malicious indicators, blacklists, or campaigns linked.

---

**2. Network Behavior**

• SSH Service:

- Open port 22 with Dropbear SSH banner.

- No known exploits or vulnerabilities detected.

• Subnet: 167.249.140.0/24.

- Abuse Density: 33% (1 high-risk, 2 medium-risk neighbors).

- High-Risk Neighbor: 167.249.140.130 (risk score 80).

- Subnet Classification: "Mostly Clean" but with inherited risk from neighbors.

---

**3. Historical Observations**

• Geolocation Stability: Consistent Brazil-based location.
• Network Scans: Detected 5+ scans (last 30 days) with mixed confidence.
• BGP Stability: Route instability flagged (likely due to subnet changes).

---

**4. Relationships**

• Linked to AS265191 (Sapucaia Comercio e informatica ltda - me).
• No connections to known malicious organizations, Tor, or CDN networks.

---

**5. Recommendations**

• Monitor Subnet: Focus on 167.249.140.130 due to elevated risk.
• Restrict SSH Access: Ensure SSH is only accessible to authorized internal hosts.
• Check Neighbor Activity: Investigate high-risk neighbors for potential lateral movement.
• Verify DNSSEC: Confirm DNSSEC validity for 167.249.140.90/24 subnet.

---

Next Steps: Correlate with internal logs for SSH access patterns and validate subnet abuse density.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.