186.96.192.87📋 Copy

# IP INTELLIGENCE BRIEFING: 186.96.192.87/32

## EXECUTIVE SUMMARY

The target IP 186.96.192.87 presents as a moderate-risk endpoint with conflicting geolocation signals. While the current profile indicates United States (New York) placement, historical observation data points to Argentina. The IP shows no active services, is firewalled, and has been listed on 3 out of 8 DNSBLs. Risk scoring reflects moderate concern (55/100) with no evidence of active malicious behavior.

## PROFILE ANALYSIS

Risk Assessment

• Overall Risk Score: 55 (Moderate Risk)
• Provider Score: 0
• Authority Score: 0
• Classification: Firewalled / No Services Detected

Geolocation Discrepancy

• Profile Data: United States, New York (US-NY)
• Historical Data: Pedro Luro, Buenos Aires, Argentina (AR)
• DNS PTR: host-186.96.192.87.luronet.com.ar (.com.ar domain)
• Organization (History): COOPERATIVA DE ELECTRICIDAD DE PEDRO LURO
• RIR (History): LACNIC

This geographic inconsistency warrants investigation. The .com.ar domain and LACNIC RIR registration strongly suggest South American origin, contradicting the US profile placement.

Network Infrastructure

• ASN: 52490 (Comcast)
• BGP Prefix: 186.96.192.0/24
• Route Stability: Not stable
• DNSBL Listings: 3 of 8 total lists
• Open Ports: None detected
• Services: None operational

## OBSERVATION HISTORY

The IP has generated 14 observations in the observation window. Recent signals (July 28, 2026) indicate:

• Geolocation Shifts: Consistent Argentina reporting across multiple geolocation sources
• Ownership: Cooperativa de Electricidad de Pedro Luro
• Abuse Contact: garciafabiang@gmail.com
• CIDR Block: 186.96.192.0/21

The historical data shows persistent Argentine infrastructure with no evidence of malicious activity patterns.

## RELATIONSHIP ANALYSIS

• DNS Associations: Single hostname (host-186.96.192.87.luronet.com.ar)
• Network Relationships: None detected
• Organizational Links: No direct organization associations beyond historical data

## NEIGHBORHOOD ANALYSIS (186.96.192.0/24)

The /24 subnet contains 23 sibling IPs with the following characteristics:

• Abuse Density: 0 (low)
• Risk Distribution: 14 medium-risk, 9 low-risk, 0 high-risk
• Neighbor Risk Scores: Range from 0-40 (all below target's 55)
• Authority Scores: Consistent 50 across all siblings

The subnet demonstrates relatively benign characteristics with no high-risk neighbors and low overall abuse density.

## THREAT INDICATORS

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0
• Threat Feeds: None populated
• Campaign Associations: None detected

## RECOMMENDED ACTIONS

1. Monitor Geolocation Inconsistency: Investigate the US vs. Argentina placement discrepancy. The .com.ar domain and LACNIC RIR data suggest the US profile may be inaccurate.

2. DNSBL Review: Examine the 3 DNSBL listings to understand listing reasons and potential false positives.

3. Traffic Monitoring: Given the "firewalled" status, monitor for any service activation or port scanning activity.

4. Subnet Context: The /24 neighborhood shows low abuse density; treat the IP as moderate risk but not indicative of broader subnet compromise.

5. Geographic Verification: Confirm actual routing origin and endpoint location for accurate threat correlation.

## CONCLUSION

IP 186.96.192.87 represents a moderate-risk endpoint with no active threat indicators. The geographic inconsistency between profile and historical data requires verification, but the overall risk profile remains contained. The IP is firewalled with no services, making it unlikely to be an active threat vector. Continue monitoring for service activation or geolocation signal changes.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.