177.44.96.105📋 Copy

IP Intelligence Briefing: 177.44.96.105

Date: 2026-06-06

---

**1. IP Profile**

• Risk Score: 55 (Moderate Risk)
• Ownership:

- ASN: 28202 (MASTER S/A, Brazil)

- Subnet: 177.44.96.0/24

- Geolocation: Brazil (SP, Lorena), 2500km accuracy radius.

• Threat Indicators: No direct malicious activity detected (no blacklists, campaigns, or known attackers).
• Network Role: Firewalled / No Services (openPorts: empty, TLS/HTTP: inactive).
• DNS:

- PTR hostname: `177-44-96-105.srs-wr.mastercabo.com.br`

- No email authentication (SPF/DKIM/DMArch missing).

• Control Plane:

- BGP prefix: `177.44.96.0/24` (AS28202), DNSSEC valid.

- RPKI invalid, IRR inconsistency detected.

---

**2. Observation History**

• Recent Signals (2026-06-06):

- Minimal operator risk (score: 0.13).

- DNS geolocation confirmed for Brazil.

- 2 DNSBL listings (out of 8 total), categorized as "medium" severity.

- No persistent threats or campaign correlations.

• Trend: Stable risk profile with no significant changes over time.

---

**3. Relationships**

• Network Associations:

- Linked to subnet `160458` (MASTER S/A, Brazil).

- DNS associations: `177-44-96-105.srs-wr.mastercabo.com.br` (21 resolved).

• No Known Malicious Connections: No ties to malware campaigns, C2 servers, or compromised entities.

---

**4. Neighborhood Analysis**

• Subnet: `177.44.96.0/24` (54 total IPs).
• Risk Distribution:

- 19 IPs flagged as high risk (80+ score).

- 30 medium-risk IPs (55–79).

- 5 low-risk IPs.

• Abuse Density: 28.3% (moderate risk concentration).
• Notable Neighbors:

- `177.44.96.16`, `177.44.96.103`, `177.44.96.107`, and `177.44.96.108` show high risk (80 score).

---

**5. Recommendations**

• Monitor Subnet: The 177.44.96.0/24 subnet has a notable abuse density. Investigate high-risk neighbors (e.g., `177.44.96.16`, `177.44.96.103`) for potential lateral movement or shared infrastructure risks.
• Verify DNS Associations: Confirm legitimacy of `mastercabo.com.br` and check for DNS-based attacks (e.g., CNAME hijacking).
• Check DNSBL Listings: Investigate why this IP is listed on 2 DNSBLs (e.g., spam or phishing activity).
• Network Segmentation: Consider isolating this subnet if it hosts sensitive assets due to the elevated risk in the neighborhood.

---

Source: IPDebrief Threat Intelligence Platform

Note: This IP shows no direct malicious activity but operates in a subnet with mixed risk. Further investigation into neighbors and DNS behavior is advised.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.