177.184.239.195📋 Copy

# INTELLIGENCE BRIEFING: 177.184.239.195/32

## Executive Summary

Target IP 177.184.239.195 presents a Moderate Risk (Score: 50) profile. The address is assigned to NEXCESS Soluções de Redes Ltda. (ASN 52924), a Brazilian hosting provider operating within the 177.184.224.0/20 block. No active services are detected, and the IP is currently firewalled with no open ports. While the address itself shows minimal direct threat indicators, the /24 subnet exhibits elevated abuse density (0.3333) with one compromised sibling IP.

## Ownership and Infrastructure

• Organization: NEXCESS Soluções de Redes Ltda. (NEXCESS)
• ASN: 52924
• Network Block: 177.184.224.0/20 (CIDR)
• Registration: LACNIC region
• Geolocation: São Vicente, São Paulo, Brazil (BR)

## Threat Assessment

• Risk Score: 50 (Moderate)
• Abuse Confidence: Not elevated
• Blacklist Status: Listed on 2 of 8 DNSBLs
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Campaign Activity: None detected

Network Context: The /24 subnet (177.184.239.0/24) contains 3 sibling IPs with 2 currently active. One sibling (177.184.239.24) shows elevated risk (Score: 25), while 177.184.239.196 remains clean (Score: 0). This suggests localized abuse within the subnet rather than widespread compromise.

## Technical Profile

• Service Status: Firewalled / No Services Detected
• Open Ports: None
• DNS Resolution: No PTR records; forward resolution failed
• Email Reputation: Not assessed (no hosted domains)
• HTTP/HTTPS: No TLS certificate or web content detected
• Traceroute: 30 hops; transit networks include Comcast and Cogent

## Observation History

13 observations recorded in recent cycles. Key findings:

• Service enumeration and port scanning detected
• Geolocation signals show Brazil consensus with transit paths through US (JFK)
• No evidence of persistent malicious activity
• Ownership stability: No changes detected

## Recommended Actions

1. Monitor the /24 subnet (177.184.239.0/24) for correlated activity given the 0.3333 abuse density

2. Block 177.184.239.24 if not already filtered (Score: 25 indicates suspicious activity)

3. Investigate 177.184.239.195 if it appears in threat feeds or generates blocked traffic

4. Apply firewall rules to deny inbound connections (no services expected; verify with port scan)

## Conclusion

The target IP is a legitimate provider address with no direct malicious indicators. However, the presence of a compromised sibling within the same /24 warrants continued monitoring. Current recommendations focus on subnet-level oversight rather than immediate blocking of this specific address.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.