177.39.116.95📋 Copy

# IP Intelligence Briefing: 177.39.116.95/32

## Executive Summary

IP address 177.39.116.95 is classified as HIGH RISK with a risk score of 70/100. The IP is associated with PARAISONET LTDA (AS262423) and is geolocated to Nova Resende, Minas Gerais, Brazil. While not classified as a known attacker or spam source, the IP exhibits elevated threat indicators including multiple DNSBL listings and unstable routing patterns.

## Ownership and Network Context

• Organization: PARAISONET LTDA
• ASN: AS262423
• CIDR Block: 177.39.112.0/21
• Geolocation: Nova Resende, Minas Gerais, Brazil (BR)
• Network Role: Web Server (HTTP/HTTPS)
• Server Software: lighttpd/1.4.39

## Threat Indicators

• DNSBL Listings: 4 of 8 total blacklists
• PTR Hostname: 177-39-116-95.paraisonet.com.br
• Email Authentication: No SPF or DMARC records configured
• Control Plane: Route stability flagged as false; DNSSEC valid
• Tor Exit Node: No
• Known Attacker/Spam Source: No

## Network Neighborhood Analysis

The /24 subnet (177.39.116.0/24) contains:

• Total Siblings: 1 additional IP analyzed
• Neighbor IP: 177.39.116.113 (Risk Score: 70)
• Subnet Abuse Density: 0
• Classification: Not classified as infrastructure type

## Historical Observation Data

Fourteen observations recorded in the system. Recent activity (2026-07-30) indicates:

• Multiple blacklist listings with high severity classification
• DNS resolution confirmed for com.br domain
• DNSSEC validation successful

## Recommended Security Actions

Immediate Mitigation: Block traffic at perimeter firewall and WAF levels.

```bash

# iptables

iptables -A INPUT -s 177.39.116.95 -j DROP

# nftables

nft add rule inet filter input ip saddr 177.39.116.95 drop

# nginx

deny 177.39.116.95;

# pfSense

177.39.116.95/32

# Cloudflare WAF

{"description":"Block 177.39.116.95 — IPDebrief risk score 70","action":"block","filter":{"expression":"ip.src eq 177.39.116.95"}}

# AWS WAF

{"Addresses":["177.39.116.95/32"],"Description":"IPDebrief risk 70"}

```

Monitoring: Increase logging verbosity and review recent activity from this IP due to elevated risk score (70/100).

## Risk Assessment

This IP presents a moderate-to-high threat level. While not associated with confirmed malicious campaigns or known attacker infrastructure, the combination of DNSBL listings, unstable routing, and lack of email authentication records warrants blocking at network perimeter. The presence of a neighboring IP (177.39.116.113) with identical risk scoring suggests potential subnet-wide abuse patterns that may warrant broader monitoring or subnet-level controls.

Priority: Medium-High

Recommendation: Implement block rules immediately; monitor for pattern-based attacks from associated subnet IPs.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.