189.217.199.80📋 Copy

# IP Intelligence Briefing: 189.217.199.80

Date: 2026-07-25

Classification: Moderate Risk Residential Endpoint

Jurisdiction: Mexico (MX)

---

## Executive Summary

IP 189.217.199.80 is a residential cable endpoint operated by Cablevisión, S.A. de C.V. (ASN: 28548) in the Venustiano Carranza region of Mexico City. The IP carries a moderate risk score of 55/100. No active threat indicators were detected, but the elevated risk score warrants monitoring and logging review.

---

## Ownership & Network Classification

---

## Threat Assessment

Risk Score: 55/100 (Moderate Risk)

Threat Indicators:

• No known attacker indicators
• No spam source classification
• No Tor exit node activity
• No known malicious campaigns
• Blacklist count: 0
• Threat feeds: Clean

Control Plane:

• DNSBL listings: 3/8 total lists
• Operator score: 0.1304 (Minimal)
• Route stability: Unstable (false)
• BGP prefix: 189.217.196.0/22

---

## Service & Port Analysis

---

## Neighborhood Analysis (189.217.199.80/24)

Subnet Risk Profile:

• Abuse Density: 0%
• Total Siblings: 1
• Threat Siblings: 0
• High Risk Neighbors: 0
• Medium Risk Neighbors: 0
• Low Risk Neighbors: 0

Assessment: No sibling IPs in the /24 subnet show malicious activity. The IP appears isolated in its subnet context.

---

## Relationship Graph

Direct Associations:

1. Same Network: 189.216.0.0 - 189.217.255.255

2. DNS Association: customer-189-217-199-80.cablevision.net.mx

No organizational or certificate-level relationships detected beyond network boundaries.

---

## Historical Signal Analysis

Observation Count: 17 signals recorded

Recent Observations (2026-07-25):

• 16:53: Subnet classified as "clean" with 0% abuse density
• 16:48: Geo-location inferred as Mexico (confidence: 52%) with coordinates 23.63, -102.55
• 16:47: Geo-validation confirmed plausible; ICMP blocked during validation
• 16:46: Residential classification confirmed with cable connection type

Temporal Analysis:

• Ownership changes: 0
• Threat persistence days: 0
• Threat observation count: 0
• Persistently malicious: False

Assessment: No historical escalation pattern detected. The IP has remained consistent in classification without evidence of malicious activity over time.

---

## Recommended Security Actions

Primary Recommendation: Increase logging verbosity and review recent activity from this IP (Severity: High)

Firewall Rules by Platform:

---

## SOC Analyst Notes

This residential IP from Mexico carries a moderate risk score but lacks active threat indicators. The elevated score likely stems from the residential classification combined with DNSBL listings. Given the residential nature and clean neighborhood analysis, the recommended action is enhanced monitoring rather than immediate blocking. Review any inbound traffic from this IP against your threat detection rules to identify potential policy violations or lateral movement attempts.

Risk Rating: Moderate

Recommended Action: Monitor with logging; evaluate traffic patterns before blocking

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.