186.122.177.140
IP Intelligence Briefing: 186.122.177.140
Date: 2026-06-17
---
**1. Risk Profile**
- Overall Risk: Moderate (Risk Score: 50)
- Ownership: Registered to AMX Argentina S.A. (ASN: 11664, RIR: LACNIC).
- Geolocation: Confirmed as Argentina (AR) via RDAP, but DNS PTR record resolves to Telmex.net.ar (Mexico). Geolocation tools inconsistently suggest San Francisco, CA, USA (37.77°N, -122.42°W) with 45km accuracy.
- Network Role: Mobile device (LTE/5G, carrier: Claro, MCC: 722, MNC: 310).
- Services:
- HTTP/HTTPS (nginx server), SSH (OpenSSH 8.9p1).
- TLS certificate issued to hestacp.vitolen.com (Hestia Control Panel).
---
**2. Threat Indicators**
- No Malicious Activity: No indicators of spam, known attackers, or malicious campaigns.
- DNS & Certificates:
- DNSSEC valid, no CAA records.
- TLS certificate has no critical extensions, self-signed: False.
- BGPs & Routing:
- Subnet 186.122.177.0/24 has abuse density 1/10 (mostly clean).
- No BGP anomalies or route instability detected.
---
**3. Observation History**
- Recent Activity (2026-06-17):
- Geolocation inferred as San Francisco, CA (37.77°N, -122.42°W) with 45km accuracy.
- DNS listings show 8 total lists (3 high-severity), but no direct malicious ties.
- Network operator score: Minimal (0.13).
---
**4. Relationships & Subnet**
- Neighboring IPs:
- Subnet 186.122.177.0/24 has 0 active IPs and 1 threat sibling (low abuse density).
- Network Connections:
- Linked to Telmex.net.ar (PTR record) and hestacp.vitolen.com (TLS certificate).
- No known malicious subnets or organizations in the same /24.
---
**5. Actionable Insights**
- Geolocation Discrepancy: The IP’s RDAP registration (Argentina) conflicts with DNS/observation data (San Francisco). Verify if the mobile device is using a proxy or misconfigured DNS.
- Monitor TLS Certificate: The certificate is tied to hestacp.vitolen.com—confirm if this is a legitimate hosting service or a potential misconfiguration.
- Subnet Health: The /24 subnet has minimal abuse, but the IP’s mobile nature warrants ongoing monitoring for anomalous traffic patterns.
- DNS Security: Ensure DNSSEC validation is enforced and investigate the Telmex.net.ar PTR record for potential spoofing risks.
---
Recommendation: Flag for further investigation due to conflicting geolocation data and mobile network origin. No immediate mitigation required unless anomalous traffic is observed.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | AMX Argentina S.A. |
| ASN | AS11664 |
| Network Name | — |
| CIDR Block | 186.122.177.0/24 |
| RIR | LACNIC |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | host140.186-122-177.telmex.net.ar |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | host140.186-122-177.telmex.net.ar |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Mobile |
| Service Purpose | Web Server |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| 22 | ssh | tcp | |
| Closed Ports | 25, 3389, 8080, 8443 (3 open / 7 scanned) | ||
| Server | nginx |
| HTTP Title | — |
| SSH Version | SSH-2.0-OpenSSH_8.9p1 |
🔐 TLS Certificate
CN=hestacp.vitolen.com, OU=IT, O=Hestia Control Panel, L=San Francisco, S=California, C=US was found on this IP. This may indicate a previously hosted website, a decommissioned service, or stale infrastructure.| SANs | None |
| Valid From | 2023-12-01T18:49:47+00:00 |
| Valid Until | 2024-11-30T18:49:47+00:00 (expired) |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_128_GCM_SHA256 |
| Signature Algorithm | sha256RSA |
| Validity Period | 365 days |
| Serial Number | 282FC43CC0D0486F31F1E519413776956C88DB22 |
| Thumbprint | 8E12536E540290E8A55732E65D22871AB6397913 |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 28% | 2 | 4 |
| routing | 27% | 2 | 3 |
| services | 28% | 2 | 4 |
| ownership | 24% | 3 | 4 |
| reputation | 26% | 1 | 3 |
| geolocation | 31% | 2 | 3 |
| Overall | 27% | 12 | 21 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Fresh
| First Seen | 2026-05-07 23:04:01 UTC |
| Last Seen | 2026-06-26 18:10:55 UTC |
| Profile Built | 2026-06-25 10:43:16 UTC |
| Data Freshness | Fresh |
| Signal Types | 26 |
| Total Observations | 28 |
Full dossier details are available via our API.