188.246.73.71📋 Copy

# IP INTELLIGENCE BRIEFING: 188.246.73.71/32

Classification: HIGH RISK

Date: 2026-07-30

Analyst: IPDebrief Intelligence

## Executive Summary

IP address 188.246.73.71 is classified as HIGH RISK (Risk Score: 80/100). The IP is associated with BLICNET infrastructure in Bosnia and Herzegovina and shows elevated threat indicators including DNSBL listings and elevated neighborhood risk density. No active services are currently detected.

## Profile Overview

## Threat Assessment

Current Threat Indicators:

• DNSBL Listed: 4 of 8 total lists
• No active services detected (firewalled/no services)
• No open ports identified
• Not Tor exit, not known attacker, not spam source
• No active threat campaigns correlated

Control Plane Analysis:

• Operator Score: 0.2609 (Basic)
• Route Stability: False
• RPKI State: Not validated
• IRR Consistency: Not validated

## Network Neighborhood Analysis

The /24 subnet (188.246.73.0/24) contains 43 sibling IPs with the following risk distribution:

• High Risk: 0
• Medium Risk: 30 (≈69.8%)
• Low Risk: 10 (≈23.3%)
• Abuse Density: 0

Notable High-Risk Neighbors (Risk Score 70):

• 188.246.73.51, .88, .98, .107, .147, .209, .220, .254

## Observation History

Recent Activity (2026-07-30):

• 13 signal observations recorded
• Consistent ASN and organization attribution (BLICNET)
• Geolocation consistently attributed to Bosnia and Herzegovina
• No significant ownership changes detected
• No persistent malicious activity observed

Geolocation Validation:

• ICMP blocked - unable to validate physical location
• Claimed coordinates: 44.7297°N, 18.0948°E
• Distance from validation point: 1,201.1 km

## Infrastructure Relationships

DNS Associations:

• pppoe-bb-71.poen.net (PPPoe broadband hostname)
• Forward resolution confirmed to poen.net

Network Affiliation:

• Same network relationship: BLICNET

## Recommended Security Actions

Immediate Actions (Critical Severity):

1. Firewall Blocking

```

iptables: iptables -A INPUT -s 188.246.73.71 -j DROP

nftables: nft add rule inet filter input ip saddr 188.246.73.71 drop

nginx: deny 188.246.73.71;

```

2. WAF Integration

- Cloudflare WAF: Block expression `ip.src eq 188.246.73.71`

- AWS WAF: Add IP 188.246.73.71/32 to block list

3. Monitoring

- Increase logging verbosity for this IP

- Review recent activity for any successful connections

- Monitor for any service enumeration attempts

Contextual Considerations:

• The subnet shows elevated abuse density (30/43 IPs with medium+ risk scores)
• Consider blocking the broader /24 range if this IP is confirmed malicious
• Monitor for correlation with known campaigns or threat actors

## Intelligence Assessment

The IP represents a moderate-to-high risk threat vector originating from BLICNET infrastructure in Bosnia and Herzegovina. While no active malicious services are currently detected, the elevated risk score (80/100) combined with DNSBL listings and neighborhood risk patterns warrant blocking at the perimeter. The PPPoE hostname pattern suggests this may be a residential or dynamic IP assignment.

Action Priority: MEDIUM-HIGH (Block immediately, monitor for evasion techniques)

---

*This briefing is generated from IPDebrief intelligence data. Validate with additional sources before operational implementation.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.