179.184.216.202📋 Copy

IP INTELLIGENCE BRIEFING: 179.184.216.202

Classification: High Risk | Date: Current Intelligence | Scope: Single IP Analysis

---

EXECUTIVE SUMMARY

IP 179.184.216.202 is classified as HIGH RISK (Risk Score: 80/100) with strong reputation indicators suggesting malicious activity. The address is associated with TIM mobile carrier infrastructure in Belo Horizonte, Minas Gerais, Brazil, and shows DNSBL presence across 8 total lists with 5 high-severity entries.

OWNERSHIP & GEOLOCATION

• Organization: TELEFÓNICA BRASIL S.A. (TELEFÓNICA)
• ASN: AS18881
• Network Block: 179.184.0.0/14
• Geolocation: Brazil, Minas Gerais, Belo Horizonte
• Infrastructure Type: Mobile Carrier (TIM LTE/5G network)
• CIDR Assignment: 179.184.216.0/22 (Control Plane)

THREAT INDICATORS

• Reputation Status: High Risk
• DNSBL Listings: 5 of 8 total lists flagged (High Severity)
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Open Services: None detected (Firewalled / No Services)
• Mobile Connection: Confirmed via TIM carrier infrastructure

NETWORK BEHAVIOR

• Connection Type: Mobile (LTE/5G technology)
• Route Stability: Unstable (isRouteStable: false)
• BGP Prefix: 179.184.216.0/22
• RPKI State: Not validated
• HTTP/HTTPS Services: None exposed

SUBNET CONTEXT (179.184.216.0/24)

• Abuse Density: 0 (Clean subnet classification)
• Neighbor IPs: 1 detected (179.184.216.38)
• Neighbor Risk Score: 25 (Moderate)
• Active Siblings: 1
• Threat Siblings: 0

OBSERVATION HISTORY

• Total Observations: 12 signals recorded
• Most Recent: 2026-07-29T22:22:35 UTC
• DNSSEC Validation: Valid
• ASN Consistency: Consistent (AS18881)
• Ownership Changes: None detected
• Threat Persistence Days: 0

RELATIONSHIP GRAPH

• Related Entities: 2 relationships identified
• Type: Same Network (197879)
• Correlated IPs: None beyond subnet scope

---

RECOMMENDED ACTIONS

1. Block at perimeter: Implement firewall rules to deny traffic to/from 179.184.216.202

2. Monitor subnet: Track activity on 179.184.216.0/24 subnet, particularly neighbor 179.184.216.38 (Risk: 25)

3. DNSBL verification: Confirm listing sources and severity for remediation planning

4. Mobile network context: Traffic originates from TIM mobile infrastructure; consider allowing if legitimate mobile use case exists

5. No immediate takedown: IP not classified as persistent malicious actor

NOTES

• High risk score despite mobile carrier origin and no open services
• DNSBL presence indicates prior or current reputation issues
• Route instability warrants monitoring for infrastructure changes
• Subnet-level abuse density remains low (0), suggesting isolated IP issue

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.