181.94.242.2📋 Copy

# IP Intelligence Briefing: 181.94.242.2/32

Classification: Low Risk | Date: July 23, 2026 | Analyst: SOC Intelligence

## Executive Summary

IP address 181.94.242.2 presents a low-risk profile (Risk Score: 25/100) with minimal threat indicators. The address is registered to NÚcleo S.A., a Paraguayan ISP under ASN 27895, though geolocation data shows conflicting origins. No active services are detected, and the IP maintains a clean threat footprint with no known malware campaigns or blacklist associations beyond minimal DNSBL presence.

## Ownership and Infrastructure

• Organization: NÚcleo S.A.
• ASN: 27895 (LACNIC RIR)
• CIDR Block: 181.94.242.0/23
• Abuse Contact: sergio.dasilva@personal.com.py
• Network Classification: Residential/Personal infrastructure
• DNS Resolution: host-2.personal.net.py

## Geolocation Analysis

Geolocation data presents conflicting signals:

• Profile Data: New York, US
• Historical Observations: Asunción, Paraguay (PY)
• MaxMind GeoLite2: Asunción, Asuncion, Paraguay
• RIR Registry: LACNIC (South America)

The hostname pattern (personal.net.py) and LACNIC registration confirm Paraguayan origin. US geolocation appears to be a geolocation service inconsistency.

## Threat Intelligence Assessment

Risk Score: 25/100 (Low Risk)

Threat Indicators:

• Blacklist Count: 0
• DNSBL Listed: 1 out of 8 total lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Campaigns: None detected

Control Plane Data:

• Operator Score: 0.1304 (Minimal)
• Route Stability: Unstable
• DNSSEC Valid: Yes
• RPKI State: Not verified

## Service Analysis

• Open Ports: None detected
• Service Status: Firewalled / No Services
• TLS Certificate: Not available
• HTTP Service: Not responding
• Mobile Carrier: None detected

The absence of open services indicates this IP is either properly configured with no public-facing services or is a residential endpoint without active service exposure.

## Network Neighborhood

• Subnet: 181.94.242.2/24
• Neighbor Count: 0
• Abuse Density: 0 (No abuse in subnet)
• High Risk Neighbors: 0
• Medium Risk Neighbors: 0
• Low Risk Neighbors: 0

The /24 subnet shows no abuse density, indicating clean neighbor infrastructure.

## Relationship Graph

• Same Network: 181.94.242.0 - 181.94.243.255
• DNS Associations: host-2.personal.net.py

No additional organizational, hostname, or certificate relationships detected beyond the local network and DNS resolution.

## Historical Observation Summary

• Total Observations: 14
• Observation Period: Recent activity through July 23, 2026
• Threat Persistence: None (0 days)
• Ownership Changes: 0

The IP has maintained consistent ownership registration with no changes observed. Historical signals confirm stable infrastructure characteristics.

## Recommended Security Actions

Immediate Action: None Required

Monitoring Recommendations:

• Monitor for service activation (new open ports)
• Track DNSBL listing status changes
• Watch for geolocation signal inconsistencies
• Monitor subnet for any abuse pattern emergence

Firewall Rule: No specific rules recommended at this time. Standard allow/deny policies based on organizational requirements apply.

## Intelligence Conclusion

IP 181.94.242.2 represents a low-risk residential or personal endpoint from Paraguayan infrastructure provider NÚcleo S.A. The IP shows no active threat indicators, no malware associations, and no known attack campaigns. The single DNSBL listing is minimal and does not constitute a significant risk factor. No immediate defensive actions are warranted. Continue routine monitoring for service activation or reputation degradation.

---

*Report generated from IPDebrief intelligence platform. Data accuracy dependent on real-time signal collection and provider feeds.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.