177.93.196.138📋 Copy

# IP Intelligence Briefing: 177.93.196.138

## Executive Summary

IP address 177.93.196.138 is a residential/proxy endpoint belonging to Holistica Provedor Internet Ltda (AS53075) in Bahia, Brazil. The address carries a low individual risk score (30/100) with no active threat indicators, but exhibits contextual risk due to elevated abuse density in its /24 subnet. No immediate blocking is recommended, but monitoring is advised.

## Ownership & Geolocation

• Organization: Holistica Provedor Internet Ltda (AS53075)
• Network Block: 177.93.192.0/19
• Country: Brazil (BR)
• Region: Bahia
• Registration: LACNIC
• Control Plane: BGP prefix 177.93.192.0/21; IS-RPKI validation status: No

## Risk Profile

• Overall Risk Score: 30/100 (Low Risk)
• Provider Risk: 0/100
• Authority Risk: 0/100
• Operator Score: 0.1304 (Minimal)
• Stability: Stable ownership with zero changes recorded
• Threat Persistence: 0 days

## Threat Indicators

• DNSBL Listings: 2 of 8 total lists
• Known Attacker: False
• Tor Exit Node: False
• Spam Source: False
• Known Campaigns: None identified
• Blacklist Count: 0 active

## Network Services & Fingerprint

• Open Ports: None detected
• Service Purpose: Firewalled / No Services
• Email Authentication: SPF/DMARC not configured
• TLS Certificates: None
• DNS Resolution: No forward resolution
• PTR Records: None

## Subnet Context (177.93.196.0/24)

• Abuse Density: 0.25 (Moderate)
• Neighbor Count: 4
• Risk Distribution: 1 high-risk, 3 medium-risk
• High-Risk Neighbor: 177.93.196.31 (Risk Score: 80)
• Medium-Risk Neighbors: 177.93.196.72, 177.93.196.228, 177.93.196.247 (Risk Score: 40 each)

## Historical Observations

Nine signals recorded through July 30, 2026:

• ASN and country signals consistently confirmed
• One AlienVault OTX signal (confidence 0.75) associated with Joao Dourado, BA region
• Operator score signals consistently rated "Minimal"
• No escalation in threat posture observed

## Recommended Actions

• Classification: Monitor (No immediate action required)
• Firewall Rule: Not recommended based on current risk profile
• WAF Rule: Not recommended
• Monitoring: Track for service activation or subnet-wide activity increases

## Intelligence Notes

The target IP is a residential/firewalled endpoint with no exposed services. While individual risk is low, the subnet context (0.25 abuse density, one high-risk neighbor at 177.93.196.31) suggests this may be a residential proxy or hosting network. The 2 DNSBL listings warrant periodic re-evaluation. No immediate blocking recommended; continue monitoring for service activation or traffic pattern changes.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.