181.41.236.174📋 Copy

# INTELLIGENCE BRIEFING: IP 181.41.236.174/32

## Executive Summary

IP 181.41.236.174 is classified as High Risk with a risk score of 80/100. The address belongs to Cooperativa Batan de Obras y Servicios Publicos Ltda (ASN 27754) in Mar del Plata, Buenos Aires, Argentina. Despite the subnet being classified as clean with zero abuse density, the individual IP demonstrates elevated threat characteristics including multiple DNSBL listings.

## Network Ownership and Geolocation

The IP address is assigned to ASN 27754, owned by Cooperativa Batan de Obras y Servicios Publicos Ltda. The network block 181.41.224.0/19 was registered under lacnic (Latin American and Caribbean RIR). Geolocation data places the IP in Mar del Plata, Buenos Aires, Argentina, with an accuracy radius of 1,500 km.

## Risk Profile and Threat Indicators

• Risk Score: 80/100 (High Risk)
• Reputation: High Risk
• DNSBL Listings: 4 out of 8 total lists
• Known Campaigns: None detected
• Threat Classification: Not identified as Tor exit node, known attacker, spam source, or proxy

No open services were detected on this IP address, which the system classifies as "Firewalled / No Services." No TLS certificates, HTTP banners, or active port services were observed during reconnaissance.

## Neighborhood Analysis

The /24 subnet (181.41.236.0/24) contains 2 additional sibling IPs with the following risk distribution:

• 181.41.236.164: Risk Score 55/100, Authority Score 50
• 181.41.236.169: Risk Score 15/100, Authority Score 50

The subnet-level abuse density is 0, classified as "clean," though the target IP shows elevated individual risk metrics.

## Observation History

Sixteen signal observations were recorded, with the most recent activity dated July 25, 2026. Historical signals indicate consistent geolocation attribution to Argentina, stable subnet classification as clean, and no ownership changes. The operator score remains at 0.1304 (Minimal). No threat persistence indicators or persistent malicious activity were observed.

## Control Plane and Routing

• BGP Prefix: 181.41.232.0/21
• Origin ASN: 27754
• Route Stability: False
• RPKI State: Not verified
• IRR Consistency: Not verified
• DNSSEC: Validated
• Hop Count: 21
• Transit Networks: Comcast, Cogent

## Recommended Security Actions

Based on the elevated risk profile, the following actions are recommended:

1. Increase logging verbosity and review recent activity from this IP address

2. Block at perimeter firewall:

- iptables: `iptables -A INPUT -s 181.41.236.174 -j DROP`

- nftables: `nft add rule inet filter input ip saddr 181.41.236.174 drop`

- nginx: `deny 181.41.236.174;`

3. WAF/Cloud Protection:

- Cloudflare WAF: Block with expression `ip.src eq 181.41.236.174`

- AWS WAF: Add IP 181.41.236.174/32 to rule set

## Intelligence Assessment

This IP address presents a significant risk despite operating in a geographically clean subnet. The high risk score (80) combined with multiple DNSBL listings suggests the address has been associated with malicious activity. The absence of open services indicates potential evasion techniques. SOC analysts should monitor or block traffic from this address pending further investigation, particularly if observed in incoming connections.

Classification: Threat Intelligence - High Risk

Recommended Action: Block with logging

Last Updated: Current intelligence cycle

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.