189.201.75.88📋 Copy

# IP Intelligence Briefing: 189.201.75.88/32

Classification: Moderate Risk (Score: 40/100)

Date: 2026-07-24

Jurisdiction: Mexico (MX)

## Executive Summary

IP 189.201.75.88 is a residential endpoint assigned to TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V. (ASN 28469) within the 189.201.0.0/17 block in Mexico City. The IP presents moderate risk with a score of 40 and is classified as a residential endpoint with no known malicious activity. The subnet shows zero abuse density and no correlated threat siblings.

## Technical Profile

Ownership & Registration:

• Organization: TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V.
• ASN: 28469 (RIR: LACNIC)
• CIDR Block: 189.201.0.0/17
• Registration Date: Not specified

Geolocation:

• Country: Mexico (MX)
• Region: Mexico City
• City: Tlaltapan
• Coordinates: 23.63°N, -102.55°W (1,200 km accuracy radius)
• Timezone: America/Mexico_City

Network Role:

• Infrastructure Type: Residential Endpoint
• Connection Type: Residential
• Not classified as cloud, CDN, VPN, proxy, Tor, hosting, or mobile

DNS Resolution:

• PTR Hostname: fixed-189-201-75-88.totalplay.net
• Forward Resolution: Confirmed
• Hosted Domains: 0
• Email Authentication: SPF and DMARC not configured

## Threat Assessment

Current Risk Indicators:

• Risk Score: 40/100 (Moderate)
• Abuse Confidence Score: Not specified
• Blacklist Count: 0
• DNSBL Listings: 2 of 8 total lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Campaigns: None

Historical Signals (18 observations):

• Most recent observations: 2026-07-24
• Geolocation signals consistently indicate Mexico
• No persistent malicious activity detected
• Threat observation count: 0
• Threat persistence days: 0

Control Plane Analysis:

• BGP Prefix: 189.201.72.0/21
• Route Stability: Unstable
• DNSSEC Valid: Yes
• RPKI State: Not assessed

## Network Context

Subnet Analysis (189.201.75.0/24):

• Abuse Density: 0 (Clean)
• Classification: Clean
• Active Siblings: 0
• Threat Siblings: 0
• Total Siblings: 1

Relationships:

• DNS Associations: fixed-189-201-75-88.totalplay.net
• Network Associations: 189.201.0.0 - 189.201.127.255

## Recommended Actions

Based on risk profile, the following blocking rules are recommended:

Firewall Rules:

• iptables: `iptables -A INPUT -s 189.201.75.88 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 189.201.75.88 drop`
• nginx: `deny 189.201.75.88;`
• pfSense: `189.201.75.88/32`

Cloud/WAF Rules:

• Cloudflare WAF: Block with expression `ip.src eq 189.201.75.88`
• AWS WAF: Add IP 189.201.75.88/32 to blocked list

## SOC Analyst Notes

This IP is associated with a residential ISP (TotalPlay) and lacks indicators of active malicious activity. The moderate risk score (40) primarily derives from 2 DNSBL listings without confirmed attack correlation. The subnet is classified as clean with no abuse density.

Recommended: Monitor for increased activity but no immediate escalation required. The IP's residential nature suggests it may generate false positives for botnet or spam activity. Correlate with threat intelligence feeds for any campaign associations before implementing blocking rules.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.