181.209.38.180📋 Copy

# IP Intelligence Briefing: 181.209.38.180/32

## Executive Summary

IP 181.209.38.180 is a low-risk residential/static IP with no active threat indicators. The address belongs to ASN 52361 (Ledesma Manuel Alejandro) within the lacnic registry. No open services, no blacklisting, and zero threat observations recorded.

## Technical Profile

Ownership & Registration:

• ASN: 52361
• Organization: Ledesma Manuel Alejandro
• Netname: 181.209.38.176 - 181.209.38.183
• CIDR Block: 181.209.38.176/29
• RIR: LACNIC (Latin American)
• Abuse Contact: ingenieriaip@arsat.com.ar

Geolocation:

• Profile: New York, US (US-NY)
• Historical Signals: Argentina (AR), Resistencia
• Discrepancy noted between current profile and historical geolocation data
• Geo consensus: Unconfirmed across sources

Network Role:

• Classification: Firewalled / No Services
• Open Ports: None detected
• DNS: PTR record active (180.38.209.181.in-addr.arpa), no forward resolution
• Not a CDN, proxy, VPN, Tor, or hosting provider

Threat Indicators:

• Risk Score: 25 (Low Risk)
• Blacklist Count: 0
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Abuse Confidence Score: Not applicable

## Temporal Analysis

Observation History (15 signals):

• Most recent observation: 2026-07-23
• Signal types: Geolocation (AR), Organization registration, ASN/RIR, Operator score
• Operator Score: 0.1304 (Minimal)
• No persistent threat patterns detected
• Zero threat observation count

Control Plane:

• BGP Prefix: 181.209.0.0/17
• Route Stability: Unstable
• DNSSEC: Valid
• DNSBL Listed: 1 of 8 total lists

## Neighborhood Analysis

Subnet: 181.209.38.180/24

• Neighbor Count: 0
• Risk Distribution: High: 0, Medium: 0, Low: 0
• Abuse Density: 0
• Threat Siblings: 0
• Active Siblings: 0

The immediate /24 subnet shows no active neighbors or threat siblings.

## Relationships

• Same Network: 181.209.38.176 - 181.209.38.183
• DNS Associations: 180.38.209.181.in-addr.arpa (repeated)

## Risk Assessment

Overall Risk: LOW

• Risk score of 25 falls within low-risk parameters
• No active threat indicators or malicious behavior
• No services running, suggesting passive or defensive use
• Historical data shows consistent ownership registration

## Recommendations

For SOC/Security Teams:

1. Monitor Geolocation Discrepancy: Investigate the conflict between profile (US) and historical signals (Argentina). This could indicate routing anomalies or potential spoofing.

2. Passive Monitoring: IP shows no active services, but maintain baseline traffic monitoring.

3. Subnet Context: The /24 and /29 subnets show zero abuse density—contextualizes this IP as non-malicious within its network.

4. No Immediate Action Required: No firewall rules or blocking recommended based on current risk profile.

Classification: Defensible / Low Priority Monitoring

---

*Data Source: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.