189.28.90.110📋 Copy

IP Intelligence Briefing: 189.28.90.110

Date: 2026-06-13

---

**1. Core Profile**

• Risk Score: Low (0/100)
• Threat Indicators: No active malware, phishing, or exploit campaigns detected.
• Geolocation:

- Reported Location: New York, NY, US (via IP geolocation).

- Actual Registration: Bolivia (BO) under TIGO ISP (LACNIC RIR).

- Discrepancy: Geolocation mismatch with network registration (Bolivia vs. US). Potential spoofing or misconfigured routing.

• Ownership:

- Organization: `admin-ipbroker` (TIGO.net.bo).

- Abuse Contact: `ipabuse@tigo.net.bo`.

- ASN: Unassigned.

---

**2. Threat Observations**

• Historical Activity (14 records):

- Low-Score Threats:

- Listed in 8 threat feeds (e.g., DNSBLs, abuse reports).

- High-severity listing in one feed (confirmed via signal_type_id 2344).

- Geolocation Conflicts:

- IP registered to Bolivia but geolocated in the US.

- Potential misrouting or spoofing.

- No Active Malicious Behavior:

- No open ports, TLS certs, or server banners detected.

---

**3. Network Relationships**

• No Direct Relationships:

- No linked domains, certificates, or subnets in the IP’s relationship graph.

- Recommendation: Investigate TIGO’s network for potential misconfigurations or compromised subnets.

---

**4. Subnet Analysis**

• Subnet: `189.28.90.110/24`
• Neighbor Risk:

- Total Siblings: 2 IPs.

- High-Risk Neighbor: `189.28.90.212` (riskScore: 50).

- Abuse Density: 0% (clean subnet).

• Action Required: Monitor `189.28.90.212` for suspicious activity, as it may be a vector for lateral movement.

---

**5. Recommendations**

1. Verify Geolocation: Confirm if the IP is legitimately hosted in the US or if there is spoofing.

2. Engage TIGO: Contact `ipabuse@tigo.net.bo` to resolve the Bolivia-US discrepancy and investigate abuse reports.

3. Monitor Neighbors: Watch `189.28.90.212` for signs of compromise or malicious traffic.

4. Threat Feed Scrutiny: Validate the high-severity listing in threat feeds to determine if it’s a false positive.

---

Conclusion:

The IP appears low-risk but exhibits critical inconsistencies (geolocation vs. registration) and historical threat feed listings. While no immediate action is required, the anomalies warrant further investigation to prevent potential misrouting or network compromise.

Tool Sources: IPDebrief (profile, history, neighbors).

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.