189.89.213.47📋 Copy

# IP Intelligence Briefing: 189.89.213.47/32

## Executive Summary

IP address 189.89.213.47 is classified as a Moderate Risk residential endpoint located in Minas Gerais, Brazil. The IP is assigned to Stratus Telecomunicacoes Ltda (AS28187) and demonstrates typical residential behavior with no active threat indicators. However, the subnet exhibits elevated risk through neighboring malicious activity.

## Profile Overview

Risk Assessment: Moderate Risk (Score: 40)

• Provider Score: 0
• Authority Score: 0
• No persistent malicious activity detected

Ownership & Registration:

• Organization: Stratus Telecomunicacoes Ltda
• ASN: 28187 (stratus telecomunicacoes ltda)
• CIDR Block: 189.89.208.0/20
• RIR: LACNIC
• Geolocation: Lavras, Minas Gerais, Brazil

Network Classification:

• Infrastructure Type: Residential
• Connection Type: Residential Endpoint
• Not classified as CDN, Cloud, VPN, Proxy, Tor, or Hosting infrastructure

## Threat Indicators

Active Threat Status: None

• No threat indicators detected
• Not a known attacker or spam source
• Not a Tor exit node
• Abuse Confidence Score: Not available

DNS Analysis:

• PTR Hostnames: as28187.mg.stratus.com.br
• Forward Resolution Count: 1
• DNSBL Listed: 2 out of 8 total lists
• No SPF or DMARC records configured

## Historical Observation Analysis

Signal History: 17 observations recorded

• Recent observations (2026-07-28) confirm residential classification with 0.85 confidence
• Geolocation signals indicate Brazil (Minas Gerais region)
• Multiple infrastructure type assessments confirmed residential endpoint
• No ownership changes detected
• Threat persistence days: 0
• Not flagged as persistently malicious

Temporal Analysis:

• Ownership Changes: 0
• Threat Observation Count: 0
• Threat Persistence Days: 0

## Network Relationships

Relationship Count: 6 total relationships

• Same Network Associations: 109775 (repeated entries)
• DNS Associations: as28187.mg.stratus.com.br (3 instances)

## Neighborhood Analysis

Subnet: 189.89.213.0/24

• Neighbor Count: 2
• Abuse Density: 0

Sibling IP Risk Distribution:

Neighborhood Risk Assessment:

• One high-risk neighbor (189.89.213.210) detected
• One medium-risk neighbor (189.89.213.100) detected
• No inherited risk from subnet activity

## Recommended Actions

Security Recommendations: Block IP 189.89.213.47

Firewall Rules:

• iptables: `iptables -A INPUT -s 189.89.213.47 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 189.89.213.47 drop`
• nginx: `deny 189.89.213.47;`
• pfSense: `189.89.213.47/32`
• Cloudflare WAF: Block expression: `ip.src eq 189.89.213.47`
• AWS WAF: Address: `189.89.213.47/32`

Operational Notes:

• While the target IP shows moderate risk, the presence of a high-risk neighbor (189.89.213.210, score 70) in the same /24 subnet warrants monitoring
• DNSBL listings (2 of 8) suggest potential reputation issues
• Residential classification with no open ports reduces immediate exploitability risk
• Consider blocking the entire /24 subnet if security posture requires, given elevated neighborhood risk

## Intelligence Narrative

The IP address 189.89.213.47 operates as a residential endpoint within a Brazilian telecom network. Historical signals indicate consistent residential behavior without escalation to malicious activity. However, the subnet environment presents elevated risk through the presence of high-risk neighboring IPs. The IP's DNSBL listings suggest prior reputation issues, though current threat indicators remain dormant. Security teams should implement blocking controls while monitoring the subnet for correlation with known malicious campaigns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.