179.108.91.2📋 Copy

# THREAT INTELLIGENCE BRIEFING: 179.108.91.2

## Executive Summary

IP 179.108.91.2 is a moderate-risk (score: 40) endpoint located in Goiânia, Brazil, associated with RAGTEK TECNOLOGIA (ASN: 263269). The IP is currently firewalled with no open services and no active threat indicators.

---

## Ownership & Infrastructure

• Organization: RAGTEK TECNOLOGIA
• ASN: 263269
• CIDR Block: 179.108.88.0/21
• RIR: LACNIC
• Geolocation: Goiânia, GO, Brazil (BR)

---

## Risk Profile

---

## Network Services & DNS

• Open Ports: None (Firewalled / No Services)
• PTR Hostnames: ns-2.ragtek.net.br
• Forward Resolution: Unconfirmed
• TLS/HTTP: No active services detected

---

## Threat Indicators

• No malicious campaigns detected
• No known threat feeds correlations
• No pulsedive risk indicators
• No certificate matches

---

## Control Plane Status

• Route Stability: Unstable (isRouteStable: false)
• DNSBL Listings: 2 of 8 total lists
• RPKI State: Not Determined
• IRR Consistency: Not Determined

---

## Neighborhood Analysis

• Subnet: 179.108.91.2/24
• Abuse Density: 0 (No neighbor threats)
• Active Siblings: 0

---

## Observation History

15 observations recorded. Signals show consistent profile:

• Provider classification: Stable
• Geolocation: Consistent Brazil attribution
• Network role: Firewalled throughout observation period
• No escalation in threat persistence or malicious activity

---

## Recommended Actions

SOC Analyst Recommendation:

• Monitor: Low priority monitoring. No active threat indicators.
• Block: Not recommended. Risk score (40) below typical blocking thresholds.
• Allow: Permissive stance appropriate for residential/infrastructure endpoint.

Firewall Rules: None required. IP is properly firewalled with no exposed services.

---

## Intelligence Narrative

The IP address 179.108.91.2 represents a static, non-service endpoint under RAGTEK TECNOLOGIA ownership in Brazil. The moderate risk rating stems from DNSBL listings rather than observed malicious activity. No threat indicators, campaigns, or abuse patterns have been identified. The subnet shows zero abuse density with no neighboring threats. Current configuration indicates a firewalled endpoint with no accessible services, suggesting legitimate infrastructure or residential use. No immediate defensive action required beyond routine monitoring.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.