189.203.99.87📋 Copy

IPDEBRIEF INTELLIGENCE BRIEFING

Target IP: 189.203.99.87/32

Classification: Residential ISP Endpoint

Date: 2026-07-24

SUMMARY

The IP address 189.203.99.87 was identified as a residential endpoint belonging to TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V. (ASN 17072). Current risk assessment indicates low risk with a score of 25 out of 100. The endpoint shows no active malicious indicators and is classified as a firewalled residential connection with no open services.

OWNERSHIP AND GEOLOCATION

The IP is allocated to the 189.203.0.0/16 CIDR block under LACNIC RIR jurisdiction. Registration is attributed to TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V., a Mexican telecommunications provider. Geolocation data places the endpoint in Guadalajara, Jalisco (JAL), Mexico. DNS reverse resolution confirms the hostname fixed-189-203-99-87.totalplay.net, with forward resolution validating this mapping.

THREAT ASSESSMENT

No threat indicators were detected during analysis. The IP does not appear as a known attacker, Tor exit node, or spam source. Blacklist enumeration returned zero entries. DNSBL listing count shows 1 listing out of 8 total checked lists, indicating minimal reputation issues. The endpoint is not flagged as persistently malicious with zero threat observation count recorded.

NETWORK BEHAVIOR

Network role classification indicates the IP is firewalled with no active services detected on open ports. No TLS certificates, HTTP banners, or server fingerprints were observed. The endpoint is not classified as cloud infrastructure, CDN, VPN, proxy, hosting, mobile carrier, or anycast traffic. Route stability is flagged as false with zero route changes in the past 30 days.

NEIGHBORHOOD ANALYSIS

The /24 subnet 189.203.99.87/24 shows clean classification with zero abuse density. The subnet contains 2 total sibling IPs with no active or threat-flagged siblings. One neighbor IP (189.203.99.182) was discovered but returned null risk metrics. The neighborhood environment presents no correlated threat activity.

HISTORICAL OBSERVATIONS

Analysis reviewed 19 historical observations spanning recent monitoring periods. Signals include ownership validation, subnet classification, geolocation mapping, and DNS ownership confirmation. No ownership changes were recorded during the observation period. Threat persistence days show zero days, indicating no sustained malicious activity pattern.

ACTIONABLE RECOMMENDATIONS

Based on the low-risk profile and residential ISP classification, no blocking or mitigation actions are recommended. The endpoint represents legitimate residential infrastructure from a major Mexican telecom provider. Standard allow rules may be applied with monitoring for behavioral changes.

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.