189.217.72.173📋 Copy

# IP Intelligence Briefing: 189.217.72.173

Date: 2026-07-24

Classification: Moderate Risk

Risk Score: 40/100

## Executive Summary

IP address 189.217.72.173 presents a moderate risk profile with conflicting geolocation indicators and historical DNS blacklist listings. The address resolves to a Cablevision domain with Mexican ISP infrastructure despite profile data indicating US origin. Current threat indicators are absent, but historical evidence suggests prior malicious activity.

## Technical Profile

## Threat Indicators

Current Status:

• DNSBL Listings: 2 of 8 lists (High severity)
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Campaign Affiliation: None detected

Historical Activity:

• 14 total observations recorded
• Maximum severity: High (DNSBL listing)
• DNSSEC validation: Valid

## Geolocation Analysis

Geolocation data presents conflicting indicators requiring analyst attention:

• Profile Data: US (Newark, NJ)
• Historical Observations: Mexico (Ciudad Nezahualcoyotl, confidence 70%)
• DNS PTR Records: customer-189-217-72-173.cablevision.net.mx
• Geographic Consensus: False (2 sources disagree)

The DNS resolution to a Mexican Cablevision domain strongly suggests the IP is associated with Mexican infrastructure, despite profile classification.

## Network Neighborhood Assessment

• Subnet: 189.217.72.0/24
• Abuse Density: 0.0 (Clean)
• Active Siblings: 0
• Threat Siblings: 0
• Classification: Clean

The /24 neighborhood shows no adjacent malicious activity, suggesting isolated behavior rather than part of a coordinated attack infrastructure.

## DNS Analysis

## Control Plane Data

• Origin ASN: 28548
• Route Stability: Unstable (changes observed in last 30 days)
• MOAS: No
• RPKI State: Not verified
• IRR Consistency: Not verified

## Recommended Actions

1. Monitor DNSBL Listings: Address is listed on 2 blacklist feeds with high severity. Investigate listing origins.

2. Geolocation Verification: Conflicting US/MX data requires investigation into actual infrastructure location.

3. DNS Resolution Check: Forward resolution not confirmed—verify DNS configuration.

4. Passive Monitoring: No active services detected; maintain monitoring for service changes.

5. Neighborhood Watch: Clean subnet but monitor for lateral expansion of any threat activity.

## Intelligence Conclusion

IP 189.217.72.173 presents a moderate risk profile with historical blacklist activity. The Mexican ISP association (Cablevision) combined with DNSBL listings suggests prior abuse activity, though current threat indicators are absent. The geolocation discrepancy between profile data (US) and DNS/resolution data (Mexico) warrants investigation to determine actual infrastructure location and ownership. Recommended for continued monitoring with moderate priority.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.