186.64.71.36
IP Intelligence Briefing: 186.64.71.36
Date: 2026-06-06
---
**1. Core Profile**
- Risk Score: 40 (Moderate Risk)
- Ownership: NODOSUD S.A (AS27953), Argentina
- Geolocation: Cordoba, Argentina (latitude/longitude unspecified)
- Network Role: Multi-service host (HTTP, SSH)
- Services:
- HTTP: Lighttpd 1.4.39 (302 redirect)
- SSH: Dropbear 2026-05-29 (banner: `SSH-2.0-dropbear`)
- TLS: No certificate detected
- Threat Indicators: No malicious activity detected in 30-day history
---
**2. Observation History**
- Recent Activity:
- HTTP server responded with 302 status code (likely redirect).
- SSH service active with Dropbear, no TLS encryption.
- Geolocation data inconsistent (geoPlausible: false, 1500km accuracy radius).
- Stability: Stable routing (BGP route unchanged in 30 days).
- DNS:
- PTR record: `host36.186-64-71.nodosud.com.ar`
- No SPF/DKIM records, no email authentication.
---
**3. Network Relationships**
- Subnet: 186.64.64.0/19 (NODOSUD S.A)
- DNS Associations:
- Linked to `host36.186-64-71.nodosud.com.ar` (multiple PTR records).
- BGP:
- AS27953 (NODOSUD S.A) peered with AS6939 and AS3356.
- No RPKI invalidations or IRR inconsistencies.
---
**4. Subnet Neighborhood**
- /24 Subnet (186.64.71.0/24):
- Abuse Density: 14.29% (moderate risk).
- High-Risk Neighbors:
- 186.64.71.55 (risk score 65).
- Active IPs: 1 out of 7 siblings (14.29%).
- Threat Siblings: 1 (14.29%).
---
**5. Threat Assessment**
- Immediate Risks:
- SSH without TLS encryption may expose credentials.
- No TLS certificate for HTTP service (potential downgrade attacks).
- Subnet Context:
- One neighbor (186.64.71.55) shows higher risk; investigate for potential botnet or compromised hosts.
- Geolocation Anomalies:
- Inconsistent geolocation data may indicate spoofing or misconfigured DNS.
---
**6. Recommendations**
1. Monitor SSH Traffic: Enforce TLS for SSH (e.g., switch to OpenSSH with TLS).
2. Verify TLS Configuration: Ensure HTTPS services use valid certificates.
3. Subnet Scanning: Prioritize 186.64.71.55 for threat analysis.
4. DNS Validation: Confirm PTR records for `host36.186-64-71.nodosud.com.ar` to avoid misattribution.
---
Source: IPDebrief Threat Intelligence Platform | Updated: 2026-06-06
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | NODOSUD S.A |
| ASN | AS27953 |
| Network Name | 186.64.64.0 - 186.64.95.255 |
| CIDR Block | 186.64.64.0/19 |
| RIR | LACNIC |
| Country | AR |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | host36.186-64-71.nodosud.com.ar |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | host36.186-64-71.nodosud.com.ar |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Multi-Service Host |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 22 | ssh | tcp | |
| Closed Ports | 25, 443, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | lighttpd/1.4.39 |
| HTTP Title | — |
| SSH Version | SSH-2.0-dropbear <$|?????x??????N??curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-gr |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 27% | 2 | 4 |
| routing | 33% | 2 | 4 |
| services | 27% | 2 | 3 |
| ownership | 30% | 3 | 4 |
| reputation | 22% | 1 | 3 |
| geolocation | 19% | 2 | 2 |
| Overall | 26% | 12 | 20 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-13 19:04:21 UTC |
| Last Seen | 2026-06-06 23:36:23 UTC |
| Profile Built | 2026-06-06 23:53:33 UTC |
| Data Freshness | Live |
| Signal Types | 24 |
| Total Observations | 29 |
Full dossier details are available via our API.