185.132.186.71📋 Copy

# IP Intelligence Briefing: 185.132.186.71

## Executive Summary

IP address 185.132.186.71 is classified as Moderate Risk (risk score: 50). The IP belongs to RIR RIPE and operates under ASN 206092 (es-digitalrm-1-mnt). No active threat indicators were identified. Geolocation data shows inconsistencies between RIR registration (GB) and MaxMind geolocation (ZA), suggesting potential routing anomalies or misconfigured DNS.

## Technical Profile

Ownership & Registration

• ASN: 206092
• Organization: es-digitalrm-1-mnt
• Network Block: 185.132.186.0/24 (ZA-IPXO-DRM-20220602)
• RIR: RIPE
• Abuse Contact: report@abuseradar.com

Geolocation Analysis

Discrepancies detected between data sources:

• RIR Registration: London, GB
• MaxMind Geolocation: Johannesburg, ZA, Gauteng
• Timezone: Europe/London
• GeoConsensus: False (2 conflicting sources)

Network Classification

• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• DNS Resolution: Forward confirmed: No (0 forward hostnames)
• Email Authentication: No SPF, DMARC, or TXT records
• Reverse DNS: No PTR hostnames

Threat Indicators

• Blacklist Count: 0
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Abuse Confidence Score: Not applicable
• Known Campaigns: None identified

Control Plane

• Origin ASN: 206092
• BGP Prefix: 185.132.186.0/24
• DNSSEC Valid: Yes
• Route Stability: False (isRouteStable: false)
• Route Changes (30d): 0
• DNSBL Listed: 2 of 8 total lists

## Neighborhood Analysis

Subnet 185.132.186.0/24 contains 79 sibling IPs with the following risk distribution:

• High Risk: 0
• Medium Risk: 10
• Low Risk: 69
• Abuse Density: 0

The subnet demonstrates low overall abuse density, indicating isolated activity rather than coordinated infrastructure.

## Observation History

11 total observations recorded. Recent signals show:

• Consistent ASN and organization data
• Persistent geolocation inconsistencies (GB/ZA)
• No observed escalation in threat profile
• No persistent malicious activity detected

## Recommended Actions

Based on risk profile (score: 50), the following firewall rules are recommended:

iptables:

```

iptables -A INPUT -s 185.132.186.71 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 185.132.186.71 drop

```

NGINX:

```

deny 185.132.186.71;

```

Cloudflare WAF:

```json

{

"description": "Block 185.132.186.71 — IPDebrief risk score 50",

"action": "block",

"filter": {

"expression": "ip.src eq 185.132.186.71"

}

}

```

AWS WAF:

```json

{

"Addresses": ["185.132.186.71/32"],

"Description": "IPDebrief risk 50"

}

```

## Intelligence Assessment

The IP presents moderate risk primarily due to geolocation inconsistencies and DNSBL listings. No active threat campaigns or known malicious activity were observed. The subnet exhibits low abuse density, suggesting this IP may be isolated or misconfigured rather than part of a coordinated attack infrastructure. SOC teams should monitor for geolocation resolution consistency and DNSBL status changes.

*Report generated from IPDebrief platform data. Rules should be validated against organizational policy before deployment.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.