186.64.95.42📋 Copy

# IP Intelligence Briefing: 186.64.95.42

## Executive Summary

IP address 186.64.95.42 is classified as High Risk (Risk Score: 80) based on provider and control plane data. The IP belongs to NODOSUD S.A (ASN 27953) within the 186.64.64.0/19 CIDR block in Argentina. While no active threat indicators or blacklisting are detected, the IP exhibits geographic anomalies and outdated server infrastructure. The surrounding /24 subnet demonstrates mixed risk characteristics with six neighboring IPs flagged as medium risk.

---

## Ownership & Classification

---

## Technical Profile

---

## Threat Assessment

• Abuse Confidence Score: Not reported
• Blacklist Status: Listed on 4 DNSBLs out of 8 total lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Associated Campaigns: None
• Known Threat Feeds: No matches

---

## Geographic Validation Anomaly

The IP's claimed geolocation (Laboulaye, Argentina) shows RTT violation:

• Claimed Distance: 11,776.6 km
• Observed RTT: 181.0 ms
• Minimum Possible RTT: 235.5 ms

This violation suggests either geolocation spoofing, routing anomalies, or incorrect ISP registration data. The geographic consensus flag is set to false.

---

## Neighborhood Analysis

Subnet: 186.64.95.0/24

High-Risk Neighbors: None detected in the /24

Medium-Risk Neighbors (Risk Score 40):

• 186.64.95.27, .31, .39, .45, .47

Low-Risk Neighbors:

• 186.64.95.61 (Score: 15)

Notable Neighbor:

• 186.64.95.220 (Risk Score: 55)

---

## Historical Observations

Total Observations: 18 signals recorded

Recent Activity (as of 2026-07-30):

• Port scanning detected
• Banner identification confirmed (Boa/0.93.15)
• Geographic validation failures persisted
• No new threat indicators emerged

Temporal Analysis:

• Threat Persistence Days: 0
• Ownership Changes: 0
• Is Persistently Malicious: False

---

## Relationship Graph

The IP has 9 documented relationships:

• 6: Same Network (186.64.64.0 - 186.64.95.255)
• 3: DNS Association (host42.186-64-95.nodosud.com.ar)

---

## Recommended Actions

Firewall Rules

```bash

# Block outbound connections to this IP

iptables -A OUTPUT -d 186.64.95.42 -j DROP

# Block inbound connections to this IP

iptables -A INPUT -s 186.64.95.42 -j DROP

```

Monitoring Recommendations

1. Monitor neighboring IPs in 186.64.95.0/24, particularly 186.64.95.220 (Risk: 55)

2. Watch for RTT anomalies on Argentina-bound traffic

3. Track DNSBL updates for this IP (currently listed on 4 of 8 lists)

4. Investigate Boa server software version (0.93.15 is outdated)

Intelligence Notes

• The high risk score (80) appears driven by control plane/operator metrics rather than active malicious activity
• No evidence of coordinated campaign participation
• Geographic validation failure warrants monitoring for potential spoofing
• ISP block (NODOSUD) shows mixed risk profile across /24 neighbors

---

Classification: High Risk

Last Updated: 2026-07-30

Data Sources: IPDebrief Control Plane, GeoValidation, Neighbor Analysis

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.