187.111.152.187📋 Copy

# Intelligence Briefing: 187.111.152.187/32

## Executive Summary

IP address 187.111.152.187 presents a high-risk security concern with a risk score of 80/100. The address belongs to Caezar Provedor de Internet EIRELI (ASN 262715) and is registered within the 187.111.144.0/20 CIDR block in Rio Grande do Sul, Brazil. No services are actively running on the address, and no known threat campaigns or blacklist matches were identified.

## Risk Profile

The IP address maintains a reputation classification of "High Risk" with an overall risk score of 80. No provider, authority, or stability scores were recorded. The address is not classified as a CDN, cloud provider, VPN, proxy, Tor exit node, hosting service, or mobile network. DNS enumeration revealed a PTR record of 187-111-152-187.caiweb.net.br, though forward resolution could not be confirmed.

## Geographic Anomalies

Geolocation validation flagged significant inconsistencies. The claimed location (São Sebastião do Caí, Brazil) produced an RTT of 152ms, which violates the minimum possible RTT of 214.3ms for the reported distance of 10,713km. GeoPlausible validation returned false with a distance of 10,712.5km from the probe location. This RTT anomaly suggests the geolocation data may be unreliable or spoofed.

## Network Infrastructure

The control plane indicates the address is associated with BGP prefix 187.111.144.0/20 under ASN 262715. Route stability is false with no route changes recorded in the past 30 days. The operator score of 0.1304 is labeled "Minimal." Four DNSBL listings were identified out of eight total lists. RPKI state and IRR consistency data were not available.

## Threat Indicators

No active threat indicators were detected. The address is not a known attacker, spam source, or Tor exit node. Blacklist count is zero. No known campaigns or threat feed matches were identified. No email authentication records (SPF, DMARC) were found. No hosted domains were resolved.

## Neighborhood Analysis

The /24 subnet (187.111.152.0/24) contains three neighboring addresses with the following risk profiles:

• 187.111.152.210: Risk score 30, Authority score 50
• 187.111.152.233: Risk score 15, Authority score 50
• 187.111.152.246: Risk score 40, Authority score 50

Subnet abuse density is zero. The risk distribution across neighbors shows one medium-risk and two low-risk addresses. No threat siblings were identified.

## Relationship Graph

Eight relationships were identified:

• Three "Same Network" relationships targeting network 139575
• Five DNS Association relationships targeting hostname 187-111-152-187.caiweb.net.br

No additional organizational, certificate, or hostname relationships were discovered beyond DNS associations.

## Historical Observations

Sixteen signal observations were recorded, with the most recent activity from July 24, 2026. Observations covered ASN, geolocation, ownership, and routing data. No ownership changes were detected. Threat persistence days and threat observation count both returned zero. The address is not classified as persistently malicious.

## Recommended Actions

Severity: Critical

Based on the elevated risk score of 80/100, the following actions are recommended:

1. Firewall Rules: Block traffic at perimeter and network level

- iptables: `iptables -A INPUT -s 187.111.152.187 -j DROP`

- nftables: `nft add rule inet filter input ip saddr 187.111.152.187 drop`

- pfSense: `187.111.152.187/32`

2. WAF Rules: Implement blocking at application layer

- Cloudflare WAF: Block IP 187.111.152.187 with expression `ip.src eq 187.111.152.187`

- AWS WAF: Add address `187.111.152.187/32` to blocking rule set

3. Monitoring: Increase logging verbosity and review recent activity from this IP address to detect any behavioral anomalies or unauthorized access attempts.

## Conclusion

While the IP address shows no active malicious indicators and no known threat campaigns, the high risk score and geolocation anomalies warrant defensive blocking and enhanced monitoring. The address should be treated as a potential security risk until further observation confirms benign behavior.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.