187.126.105.42
IP Intelligence Briefing: 187.126.105.42/32
Date: 2026-06-17
---
**1. Risk Profile**
- Overall Risk Score: 80/100 (High Risk)
- Threat Indicators:
- Listed in 6/8 DNSBLs (e.g., Spamhaus, OpenDNS, etc.).
- BGP Route Instability: Route stability score of 0/100, with frequent route changes.
- Geolocation Discrepancy: RTT (145ms) inconsistent with claimed distance (9,661km), suggesting spoofing or misconfigured infrastructure.
---
**2. Ownership & Network**
- ASN: 7738 (V tal, Brazil)
- Subnet: 187.126.96.0/20 (RJ, Rio de Janeiro, Brazil)
- Network Role: Single-service host (SSH open on port 22).
- BGP Data:
- Route Stability: 0/100 (unstable routes).
- RPKI State: Not validated.
- IRR Consistency: Not reported.
---
**3. Threat Observations**
- DNSBL Listings:
- 6/8 DNSBLs flag the IP (e.g., Spamhaus, OpenDNS, etc.).
- Abuse Confidence Score: 0 (no abuse reports).
- Historical Activity:
- First observed on 2026-06-02; no persistent malicious activity detected.
- Recent listing on 2026-06-17 with high-severity indicators.
- Geolocation Validity:
- Plausibility: False (RTT inconsistency with geographic distance).
---
**4. Network Relationships**
- DNS Associations:
- Linked to `187-126-105-42.user.vtal.net.br` (PTR record).
- No other hostnames or domains associated.
- Subnet Neighbors:
- /24 subnet (187.126.105.0/24) has 0 active neighbors, suggesting isolation or misconfigured network.
---
**5. Security Actions**
- Recommended Mitigations:
- Block IP: Implement firewall rules to drop traffic from 187.126.105.42/32.
- Monitor SSH: Check for brute-force attempts on port 22.
- Investigate BGP: Verify route stability and RPKI validation for ASN 7738.
---
**6. Summary**
This IP exhibits high-risk behavior due to DNSBL listings, unstable BGP routes, and geolocation anomalies. While no direct malicious activity is detected, the combination of factors suggests potential spoofing, misconfigured infrastructure, or compromised systems. Immediate blocking and network validation are advised.
Next Steps:
- Confirm DNSBL listings with upstream providers.
- Validate BGP route stability and RPKI compliance.
- Monitor SSH logs for unauthorized access attempts.
Tools Used: IPDebrief Profile, History, Relationships, Neighbors, Actions.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | V tal |
| ASN | AS7738 |
| Network Name | 516438 |
| CIDR Block | 187.126.96.0/20 |
| RIR | LACNIC |
| Country | BR |
| Abuse Contact | — |
🌐 DNS Intelligence
| PTR | 187-126-105-42.user.vtal.net.br |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | 187-126-105-42.user.vtal.net.br |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Single-Service Host |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 22 | ssh | tcp | |
| Closed Ports | 25, 80, 443, 3389, 8080, 8443 (1 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
| SSH Version | SSH-2.0-OpenSSH_6.7 |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 43% | 2 | 5 |
| routing | 13% | 1 | 1 |
| services | 15% | 2 | 2 |
| ownership | 19% | 2 | 2 |
| reputation | 26% | 1 | 3 |
| geolocation | 30% | 2 | 3 |
| Overall | 24% | 10 | 16 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Moderate (55%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-07 23:04:02 UTC |
| Last Seen | 2026-06-26 18:10:56 UTC |
| Profile Built | 2026-06-23 01:46:25 UTC |
| Data Freshness | Live |
| Signal Types | 21 |
| Total Observations | 23 |
Full dossier details are available via our API.