187.190.28.172📋 Copy

# IP Intelligence Briefing: 187.190.28.172/32

## Executive Summary

IP address 187.190.28.172 is classified as a residential endpoint with a low risk score (30/100). The address belongs to TotalPlay Telecomunicaciones, S.A.P.I. DE C.V. (ASN 17072) and is part of the 187.190.0.0/16 block registered under LACNIC. No active threat indicators, blacklist entries, or malicious campaigns were detected during analysis.

## Ownership and Network Classification

• Organization: TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V.
• ASN: 17072
• CIDR Block: 187.190.0.0/16
• RIR: LACNIC
• Infrastructure Type: Residential Endpoint
• Network Role: Residential (not hosting, CDN, cloud, VPN, or proxy)

## Geolocation Assessment

Analysis revealed geolocation data inconsistency between sources. While ASN registry data indicates Mexican registration (LACNIC), geolocation probes returned US (New York, US-NY) coordinates. This discrepancy (geoConsensus: false, geoPlausible: false) suggests either misconfigured routing or inconsistent geolocation databases. The IP should be evaluated based on origin rather than geolocation alone.

## Threat Intelligence Findings

• Risk Score: 30 (Low Risk)
• Abuse Confidence Score: Not reported
• Blacklist Status: 0 blacklist entries
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Known Campaigns: None identified
• Persistently Malicious: No

## Technical Observations

• DNS Resolution: PTR hostname fixed-187-190-28-172.totalplay.net
• Forward Resolution: Confirmed
• Email Authentication: No SPF or DMARC records present
• Open Ports: None detected
• TLS/Certificates: No active TLS certificates
• Control Plane: Route stable, 2 DNSBL listings detected, operator score 0.2609 (Basic)

## Historical Analysis

Sixteen observations recorded as of July 23, 2026. The IP demonstrates consistent residential classification with zero ownership changes and zero threat observation count. No evidence of escalating risk profile or persistent malicious behavior.

## Network Relationships

Three associations identified:

1. DNS hostname: fixed-187-190-28-172.totalplay.net

2. Same network block: 187.190.0.0 - 187.190.255.255

## Subnet Analysis (/24)

The 187.190.28.0/24 subnet shows:

• Abuse Density: 0 (no abuse activity detected)
• Neighbor Count: 1 (187.190.28.6 with risk score 15)
• Risk Distribution: All neighbors classified as low risk

## Recommended Actions

Based on the low-risk residential classification and absence of threat indicators, no immediate blocking or mitigation actions are required. The IP represents a legitimate residential endpoint with stable ownership history.

Analyst Notes: Monitor for any changes in geolocation consistency or emergence of threat indicators. The residential nature of the endpoint combined with the lack of hosting/proxy characteristics supports legitimate residential use case.

---

*Intelligence generated using IPDebrief threat intelligence platform. Data current as of analysis timestamp.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.