187.120.73.73📋 Copy

Threat Intelligence Briefing: IP 187.120.73.73/32

Overview:

• Risk Profile: Moderate Risk (Risk Score: 55)
• Ownership: Registered to MASTER S/A (ASN 28202) in Brazil (Minas Gerais, Delfim Moreira).
• Network Role: Firewalled / No Services (no open ports or TLS certificates detected).
• Geolocation: Consistent with Brazil, but DNS geolocation shows inferred location in São Paulo with 2500km accuracy radius.

Threat Indicators:

• No direct malicious indicators (no abuse confidence scores, blacklist entries, or known campaigns).
• Subnet abuse density: 17.9% (moderate risk).
• High-risk neighbors include IPs with risk scores up to 80 (e.g., 187.120.73.121, 187.120.73.173).

Observation History:

• First recorded on June 2, 2026, as part of a network associated with a data center in São Paulo.
• No persistent threat activity detected; observed as a static, non-malicious IP.

Network Relationships:

• Linked to ASN 28202 (MASTER S/A) and network block 187.120.64.0/18.
• Subnet 187.120.73.0/24 contains 39 IPs, with 7 high-risk, 30 medium-risk, and 2 low-risk neighbors.

Actionable Intelligence:

1. Monitor Subnet Activity: The IP’s subnet contains high-risk neighbors (e.g., 187.120.73.121, 187.120.73.173). Investigate potential lateral movement or shared infrastructure risks.

2. Verify Geolocation Anomalies: The IP’s DNS geolocation suggests São Paulo, but its inferred location is inconsistent with its registered region. Validate with additional probes.

3. Secure Network Segmentation: Ensure the IP’s firewalled nature is maintained, and restrict access to critical systems due to its proximity to higher-risk assets.

Conclusion:

This IP is likely a data center server in Brazil with no direct malicious activity. However, its subnet’s mixed risk profile warrants closer monitoring. SOC teams should prioritize isolating high-risk neighbors and verifying geolocation discrepancies.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.