189.217.205.24📋 Copy

## IP Intelligence Briefing: 189.217.205.24

Classification: Moderate Risk Residential Endpoint

Risk Score: 55/100

Date: July 24, 2026

Executive Summary

IP address 189.217.205.24 is a residential cable connection endpoint located in Venustiano Carranza, Mexico City, operated by Cablevisión, S.A. de C.V. (ASN 28548). The IP presents moderate risk (55/100) with no confirmed malicious activity but exhibits DNSBL listings that warrant monitoring.

Ownership and Geolocation

• Organization: Cablevisión, S.A. de C.V.
• Network Block: 189.216.0.0/15 (189.216.0.0 - 189.217.255.255)
• Country: Mexico (MX)
• City: Venustiano Carranza
• Infrastructure Type: Residential, Cable Connection
• PTR Hostname: customer-189-217-205-24.cablevision.net.mx

Threat Indicators

• Risk Score: 55 (Moderate)
• Abuse Confidence: Not elevated
• Known Attacker: No
• Spam Source: No
• Tor Exit/Proxy: No
• DNSBL Status: Listed on 3 of 8 blacklists (max severity: high)
• Campaign Correlation: No known campaigns or certificate matches

Network Context

• Subnet Classification: Clean (189.217.205.0/24)
• Abuse Density: 0%
• Neighboring IPs: No active or threat siblings detected
• Control Plane: Route stable; DNSSEC valid

Historical Signals

Analysis of 18 observations indicates:

• No persistent malicious activity detected
• Geographic signals consistently point to Mexico with 52-85% confidence
• One signal (2026-07-24) confirmed DNSBL listings across multiple feeds
• Ownership stability: No recent changes recorded

Recommended Actions

Immediate:

1. Increase logging verbosity for traffic from this IP

2. Review recent activity patterns and connection logs

Mitigation Controls:

```

iptables -A INPUT -s 189.217.205.24 -j DROP

nft add rule inet filter input ip saddr 189.217.205.24 drop

nginx: deny 189.217.205.24;

```

Intelligence Assessment

This IP represents a legitimate residential endpoint with elevated DNSBL presence but no confirmed malicious indicators. The moderate risk score (55/100) primarily stems from blacklist associations rather than active threat behavior. SOC teams should monitor for escalation but may consider blocking at the network perimeter if threat correlation increases. No immediate escalation to high-priority incident is warranted based on current signals.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.