182.9.2.216📋 Copy

# IPDEBRIEF THREAT INTELLIGENCE BRIEFING

IP Address: 182.9.2.216/32

Classification: Moderate Risk (Score: 65/100)

Date: 2026-07-30

---

## EXECUTIVE SUMMARY

IP 182.9.2.216 is a moderate-risk Indonesian infrastructure address associated with IRT-IDNIC-ID (ASN 23693). Despite an elevated risk score, the IP shows no active malicious indicators, no known threat campaigns, and no running services. The risk score is primarily driven by DNSBL listings (3/8) and geolocation validation anomalies.

---

## OWNERSHIP & GEOLOCATION

• Organization: IRT-IDNIC-ID (TELKOMSEL-ID)
• ASN: 23693 (APNIC RIR)
• Country: Indonesia (ID)
• Region: Bengkulu
• CIDR Block: 182.0.0.0/12
• Registration: Network registration details available via RDAP

---

## THREAT INDICATORS

• Risk Score: 65/100 (Moderate)
• Blacklist Status: 0 blacklists (blacklistCount: 0)
• DNSBL Listings: 3/8 total lists
• Tor Exit: No
• Known Attacker: No
• Spam Source: No
• Abuse Confidence Score: Not calculated
• Campaign Association: None detected

---

## NETWORK PROFILE

• Service Status: Firewalled / No Services Detected
• Open Ports: None
• DNS Status: No PTR records, forward resolution failed
• TLS/HTTPS: Not detected
• Network Classification: Provider infrastructure
• Mobile: No
• Residential: No
• CDN/Proxy/VPN: No

---

## OBSERVATION HISTORY

• Total Observations: 13 signals
• Recent Activity: All observations from 2026-07-30
• Threat Persistence: 0 days
• Ownership Changes: 0
• Threat Observation Count: 0
• Is Persistently Malicious: No

Key Findings: No temporal escalation in risk. The IP has remained static with no evidence of becoming more or less dangerous over the observation period.

---

## NEIGHBORHOOD ANALYSIS (182.9.2.0/24)

• Abuse Density: 0 (Low)
• Total Siblings: 3
• Risk Distribution: High: 0, Medium: 0, Low: 3
• Neighbor IPs:

- 182.9.2.50 (Risk: 25)

- 182.9.2.115 (Risk: 0)

- 182.9.2.144 (Risk: 25)

The /24 subnet exhibits low abuse density with no high-risk neighbors.

---

## RELATIONSHIP GRAPH

• Same Network Links: 2 relationships to TELKOMSEL-ID network
• Related Hostnames: None
• Associated Organizations: None beyond network owner
• Certificates: None detected

---

## RECOMMENDED ACTIONS

Immediate

1. Increase Logging Verbosity – Review recent activity from this IP due to elevated risk score (65/100)

Firewall Implementation

• iptables: `iptables -A INPUT -s 182.9.2.216 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 182.9.2.216 drop`
• nginx: `deny 182.9.2.216;`
• pfSense: Add 182.9.2.216/32 to block list
• Cloudflare WAF: Block IP with expression `ip.src eq 182.9.2.216`
• AWS WAF: Add 182.9.2.216/32 to IP set

---

## ANALYST NOTES

While the risk score of 65 suggests caution, the absence of active threat indicators, known campaigns, and malicious behavior suggests this may be a false positive or dormant infrastructure. The moderate risk classification is driven by DNSBL listings rather than confirmed malicious activity. Monitor for service discovery or behavioral changes. No immediate threat to SOC operations detected, but logging and monitoring recommended.

---

*Intelligence generated by IPDebrief. Recommendations are probabilistic and should be combined with additional signals before taking action.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.