189.28.90.185📋 Copy

# INTELLIGENCE BRIEFING: 189.28.90.185

## Executive Summary

IP address 189.28.90.185 presents a low-risk profile with no active threat indicators. The endpoint is associated with IP brokerage infrastructure (admin-ipbroker, ASN 27882) and maintains minimal network activity. No immediate defensive action is recommended, though geolocation inconsistencies warrant periodic monitoring.

## Risk Assessment

• Risk Score: 0 (Low Risk)
• Reputation: Low Risk
• Abuse Confidence: None detected
• Blacklist Status: Clean (0 listings across 8 DNSBLs)
• Known Campaigns: None correlated

## Network & Ownership Intelligence

Note: The IP belongs to a registered IP brokerage infrastructure. The .bo TLD in DNS hostnames indicates Bolivian administrative registration, though geolocation data indicates US presence (New York, NY) with a 10,464 km distance discrepancy suggesting potential geolocation validation issues.

## Technical Profile

• Network Role: Infrastructure / Firewalled
• Service Exposure: No open ports detected
• DNS Resolution: LPZ-189-28-90-00185.tigo.bo (1 forward record)
• Email Authentication: No SPF/DMARC records configured
• Control Plane: Route stable, origin ASN 27882, RPKI state pending
• Mobile/Proxy Detection: Not identified as mobile, proxy, CDN, or Tor exit node

## Neighborhood Analysis (189.28.90.0/24)

Neighbor IPs:

• 189.28.90.110 (Risk Score: 25, Authority Score: 50)
• 189.28.90.187 (Risk Score: 25, Authority Score: 50)
• 189.28.90.212 (Risk Score: 25, Authority Score: 50)

All neighbors maintain low-risk profiles with moderate authority scores, indicating a generally stable subnet environment.

## Historical Observations

• Total Observations: 16 signals
• Threat Persistence: 0 days
• Ownership Changes: 0
• Recent Activity: Last observed 2026-07-28
• Threat Trend: Stable (no escalation detected)

Key historical signals include:

• Consistent LACNIC RIR registration
• Persistent DNS associations with tigo.bo infrastructure
• No emergence of new threat indicators

## Recommended Actions

Current Status: No immediate action required. The IP maintains a low-risk profile with no active threat indicators or firewall rule recommendations.

Monitoring Considerations:

• Monitor for geolocation consistency between DNS (.bo) and network-level data
• Periodic re-evaluation recommended given the IP brokerage nature
• Watch for any new service exposure or DNSBL listings

## Conclusion

IP 189.28.90.185 represents infrastructure-level traffic from a registered IP broker with no evidence of malicious activity. The endpoint is firewalled with no service exposure. The primary intelligence concern is the geolocation discrepancy between administrative DNS records (Bolivia) and network-level geolocation data (US). Standard monitoring protocols are sufficient; no immediate blocking or filtering is warranted.

---

*Report generated: 2026-07-28 | Classification: Unrestricted*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.