177.72.14.131📋 Copy

IP Intelligence Briefing: 177.72.14.131

Date: 2026-06-17

---

**1. Risk Profile**

• Risk Score: 70 (High Risk)
• Threat Indicators: No direct malicious indicators (no malware, phishing, or C2 activity).
• Network Role: Web server (ports 80/443/22 open).
• Ownership: Registered to INTERNET PLAY LTDA (AS52814) in Brazil (SP, Araçatuba).
• Geolocation: Brazil (SP, Araçatuba), with a plausible geolocation consensus.

---

**2. Network & Service Analysis**

• Services:

- HTTP/HTTPS (port 80/443) with server banner: `lighttpd/1.4.39`.

- SSH (port 22) using Dropbear, with banner: `SSH-2.0-dropbear_2016.74`.

• DNS:

- PTR hostname: `177-72-14-131.internetplay.net.br`.

- No email authentication (SPF/DKIM/DARC) detected.

• TLS: No certificate data available.

---

**3. Threat & Security Observations**

• Historical Signals (Last 30 Days):

- 12 observations (40% confidence).

- Mixed routing data (DNSSEC valid, but operator score: 0.26).

- One connection failure (HTTPS fingerprinting attempt).

- No persistent malicious activity or campaign correlations.

• DNSBL Listings: 4 out of 8 lists (e.g., Spamhaus, Project Honey Pot).

---

**4. Network Relationships**

• Linked Entities:

- DNS: `177-72-14-131.internetplay.net.br`.

- Network: `192181` (AS52814).

• Subnet: `177.72.14.131/24` (abuse density: 1/100, classification: "mostly clean").
• Neighbors: No active neighbors reported in the /24 subnet.

---

**5. Actionable Recommendations**

1. Monitor SSH Service:

- Investigate Dropbear SSH service for unauthorized access attempts or known vulnerabilities.

2. Review DNS Configuration:

- Ensure DNSSEC and SPF/DKIM records are properly configured to mitigate spoofing risks.

3. Check DNSBL Status:

- Investigate why this IP is listed on 4 DNSBLs (e.g., Spamhaus, OpenBL).

4. Network Segmentation:

- Verify subnet isolation (177.72.14.0/24) to limit lateral movement risks.

5. Continuous Monitoring:

- Track changes in threat signals and DNS resolution patterns.

---

Conclusion:

This IP exhibits high-risk behavior due to its network configuration, DNSBL listings, and open services. While no direct malicious activity is detected, its association with a Brazilian ISP and potential misconfigurations warrant further investigation. Prioritize securing SSH and DNS services, and monitor for anomalies in the subnet.

Tools Used: IPDebrief Profile, History, Relationships, Neighbors.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.