189.28.91.124📋 Copy

# Threat Intelligence Briefing: 189.28.91.124

Classification: LOW RISK

Date: 2026-07-26

Analyst: IPDebrief Intelligence Team

## Executive Summary

IP address 189.28.91.124 presents as a low-risk infrastructure asset with no active threat indicators. The IP is associated with Tigo Bolivia (Admin-IPBroker) and is currently firewalled with no active services. While the broader /24 subnet shows moderate abuse density, this specific address shows no malicious activity.

## Technical Profile

## Threat Assessment

Current Risk Status: No active threats detected

• No threat indicators in feeds
• Not listed on any blacklists (0/8 DNSBL)
• Not identified as Tor exit node, proxy, or known attacker
• No spam source reputation

Service Analysis:

• No open ports detected
• No TLS certificates or HTTP services running
• Classification: Firewalled / No Services

## Network Context

Subnet Analysis (189.28.91.0/24):

• Abuse Density: 0.5 (moderate)
• Classification: Mostly clean
• Total sibling IPs: 2
• Active sibling IPs: 1
• Threat sibling IPs: 1
• Notable neighbor: 189.28.91.162 (Risk Score: 25)

Control Plane:

• BGP Prefix: 189.28.91.0/24
• Route Stability: False
• DNSSEC: Valid
• Route Changes (30d): 0

## DNS & Hostname Associations

• PTR Record: LPZ-189-28-91-00124.tigo.bo
• Forward Resolution: tigo.bo
• Hosted Domain Count: 0
• Email Authentication: None (no SPF/DMARC configured)

## Historical Signals

Observation Count: 17 signals recorded

• Most recent: 2026-07-26 16:38 UTC
• Ownership Changes: 0
• Threat Persistence Days: 0
• Persistent Malicious Activity: False

## Intelligence Observations

1. Infrastructure Asset: IP appears to be part of a residential/corporate ISP allocation (Tigo Bolivia) with no hosting or proxy services configured.

2. Minimal Footprint: No reverse DNS issues, no open services, no historical abuse patterns.

3. Subnet Context: The /24 neighborhood contains one identified threat IP (189.28.91.162). Analysts should monitor this address for potential lateral activity.

4. Route Instability: Route is flagged as unstable, which may warrant monitoring for future infrastructure changes.

## Recommended Actions

Immediate: No blocking or firewall rules recommended. Risk score is zero with no active threat indicators.

Monitoring: Add to watchlist for subnet-level intelligence. Monitor 189.28.91.162 for continued malicious activity.

Long-term: No action required. IP maintains low-risk profile.

---

*Report generated by IPDebrief Intelligence Platform. This briefing is based on collected intelligence signals and should be correlated with additional threat data before operational decisions.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.