187.110.64.130📋 Copy

# IP Intelligence Briefing: 187.110.64.130/32

Date: 2026-07-24

Classification: High Risk (70/100)

Analyst: IPDebrief Intelligence Team

---

## EXECUTIVE SUMMARY

IP address 187.110.64.130/32 presents an elevated security risk profile with a risk score of 70/100. The IP is assigned to PROVEDORA CMA INTERNET LTDA (ASN 28624) and is geolocated to Arapiraca, Alagoas, Brazil. While the subnet demonstrates clean abuse density and no active threat indicators, the IP is listed on four DNSBL entries and is classified as firewalled with no observable services.

---

## OWNERSHIP AND GEOLOCATION

• Organization: PROVEDORA CMA INTERNET LTDA
• ASN: 28624 (LACNIC region)
• CIDR Block: 187.110.64.0/19
• Country: Brazil (BR)
• Region/State: Alagoas
• City: Arapiraca
• Registration: RIR registration confirmed via LACNIC

---

## THREAT INDICATORS

Risk Assessment: High Risk (70/100)

DNSBL Status: Listed on 4 of 8 threat intelligence lists

Known Attacker: No

Tor Exit Node: No

Spam Source: No

Notable Indicators:

• DNSBL enumeration across multiple threat feeds
• Elevated risk score despite absence of active threat indicators
• PTR hostname resolves to: porta130.google-cache.as28624.oops.net.br

---

## NETWORK CLASSIFICATION

• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• TLS Certificate: None
• HTTP Title: None
• Infrastructure Type: Not CDN, not cloud, not hosting
• Mobile Carrier: None

Control Plane:

• BGP Prefix: 187.110.64.0/24
• Origin ASN: 28624
• Route Stability: False (route changes detected in 30-day window)
• RPKI State: Not validated
• DNSSEC: Valid

---

## NEIGHBORHOOD ANALYSIS

Subnet: 187.110.64.130/24

Abuse Density: 0 (Clean)

Total Siblings: 1

Active Siblings: 0

Threat Siblings: 0

The /24 subnet demonstrates no inherited risk from neighboring addresses, suggesting localized risk concentration on this specific host.

---

## OBSERVATION HISTORY

Total Observations: 14 signals recorded

Most Recent Activity: 2026-07-24 03:27:31 UTC

Signal Timeline Highlights:

• Geolocation signals consistently point to Brazil (Alagoas region)
• ASN signals confirm PROVEDORA CMA INTERNET LTDA ownership
• Subnet classification signals indicate clean neighborhood status
• Operator score: 0.1304 (Minimal)
• Signal confidence ranges from 0.30 to 0.95

---

## RELATIONSHIP MAPPING

Connected Entities:

1. Same Network: 138470 (repeated entries indicate network association)

2. DNS Association: porta130.google-cache.as28624.oops.net.br (multiple DNS resolution records)

Relationship Count: 5 total relationships detected

---

## RECOMMENDED ACTIONS

Security Posture: Moderate Risk – Monitor/Block

Recommended Actions:

1. Firewall: Block at perimeter (iptables/nftables/Cloudflare/AWS WAF)

2. Logging: Increase verbosity and review recent activity

3. Monitoring: Add to watchlist for behavioral analysis

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 187.110.64.130 -j DROP

# nftables

nft add rule inet filter input ip saddr 187.110.64.130 drop

```

Cloud/WAF Recommendations:

• Cloudflare WAF: Block with expression `ip.src eq 187.110.64.130`
• AWS WAF: Add 187.110.64.130/32 to IP set for blocking

---

## ANALYSIS NOTES

The IP exhibits a risk score discrepancy between its elevated score (70) and clean current indicators (no open services, no known campaigns, clean neighborhood). The DNSBL listings and historical risk scoring suggest this IP may have been associated with malicious activity in the past. The PTR hostname suggests the IP may have been repurposed from Google cache infrastructure.

Threat Persistence: 0 days observed

Campaign Likelihood: Not correlated

Banner Matches: None detected

---

End of Briefing

*Intel generated by IPDebrief Threat Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.