189.190.217.141📋 Copy

# IPDebrief Intelligence Briefing

IP Address: 189.190.217.141/32

Date: Current Analysis

Classification: Moderate Risk

Risk Score: 65/100

---

## Executive Summary

IP address 189.190.217.141 is classified as a Moderate Risk endpoint (65/100). The address is associated with a mobile carrier network (Telcel/LTE-5G) under the UniNet organization. While the IP exhibits no active threat indicators, geographic discrepancies and a risk score of 65 warrant monitoring. The subnet shows no abuse density, suggesting this may be an isolated high-risk device rather than part of a coordinated malicious infrastructure.

---

## Ownership & Network Context

Note: Geographic data presents conflicting signals. RIR registration and IP geolocation indicate US/LACNIC, while mobile carrier data (MCC:334, MNC:020) indicates Mexico. This discrepancy may indicate roaming, proxy usage, or data inconsistency.

---

## Threat Assessment

The IP shows no active threat indicators. No known malware campaigns, attacker signatures, or spam sources are associated with this address. The 3 DNSBL listings require further investigation.

---

## Neighborhood Analysis

The /24 subnet (189.190.217.0/24) presents a clean profile:

• Abuse Density: 0
• Subnet Classification: Clean
• Threat Siblings: 0
• Active Siblings: 0

This suggests the elevated risk score is isolated to this single IP rather than indicative of broader subnet compromise.

---

## Historical Signals

Observation Count: 18 signals recorded

Recent observation trends show:

• Geographic signals inconsistent between US and Mexico (confidence: 0.30-0.95)
• Ownership signals consistently point to LACNIC/UniNet
• Neighborhood signals show clean classification
• No observed changes in threat profile over the observation period

---

## Technical Observations

The dynamic PTR hostname pattern (dsl-141-217-190-189-dynamic) is typical of carrier-grade NAT or residential mobile connections.

---

## Recommended Actions

Immediate

1. Increase logging verbosity for traffic from this IP

2. Review recent activity to establish baseline behavior

3. Monitor DNSBL listings (3 of 8) for specific content

Firewall/Blocking Options

iptables:

```bash

iptables -A INPUT -s 189.190.217.141 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 189.190.217.141 drop

```

nginx:

```nginx

deny 189.190.217.141;

```

pfSense/Cloudflare/AWS WAF: Use provided rule templates with IPDebrief risk score 65

---

## Analyst Notes

• Risk Score 65 is elevated but lacks supporting threat indicators
• Mobile carrier association (Telcel/Mexico) conflicts with US geolocation—investigate routing path
• No open ports suggests the IP is either residential, firewalled, or actively defended
• Clean subnet indicates this may be an isolated endpoint requiring monitoring rather than part of a botnet or malicious infrastructure

Recommendation: Monitor for 14-30 days. If no legitimate traffic pattern emerges or threat indicators appear, consider blocking based on organizational policy for moderate-risk mobile endpoints.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.