190.11.195.199📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Subject: 190.11.195.199/32

Date: 2026-07-26

Classification: Moderate Risk

Risk Score: 40

---

## EXECUTIVE SUMMARY

IP 190.11.195.199 presents a moderate risk profile with a reputation score of 40. The address is geolocated to Cordoba, Argentina (AS27953 nodosud s.a) and is associated with a hostname under the nodosud.com.ar domain. The IP shows evidence of DNS blacklist listing (2 of 8 total lists, high severity) but no active open ports or services detected. Neighborhood analysis of the /24 subnet indicates mixed risk distribution with two medium-risk and two low-risk siblings.

---

## TECHNICAL PROFILE

Ownership & Network Classification

• ASN: AS27953 nodosud s.a
• BGP Prefix: 190.11.195.0/24
• Infrastructure Type: Firewalled / No Services
• Cloud/CDN/VPN: No
• ISP Classification: Regional Internet Service Provider

Geolocation

• Country: Argentina (AR)
• Region: Cordoba
• City: Wenceslao Escalante
• Accuracy Radius: 1,500 km
• Geo Consensus: Validated across multiple sources

DNS & Hostname Resolution

• PTR Hostname: host199.190-11-195.nodosud.com.ar
• Forward Resolution: Confirmed (host199.190-11-195.nodosud.com.ar)
• DNSSEC: Valid
• Email Authentication: SPF and DMARC not configured

Service Status

• Open Ports: None detected
• TLS/HTTP: No active services
• Banner Grabbing: No response

---

## THREAT INDICATORS

Blacklist Presence

• Total Lists: 8
• Listed Count: 2
• Maximum Severity: High
• DNSBL List Count: 2

Threat Assessment

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Active Campaigns: None identified
• Threat Feeds: No correlations

Control Plane Metrics

• Route Stability: False (inconsistent routing)
• RPKI State: Not validated
• IRR Consistency: Not available
• Operator Score: 0.1304 (Minimal)

---

## OBSERVATION HISTORY (13 Total Signals)

Recent temporal analysis shows:

• Geolocation Signals: Multiple observations consistently pointing to Argentina with confidence scores ranging 0.35-0.60
• Operator Assessment: Minimal operator risk (0.1304) with DNSSEC validation present
• Threat Signals: ASN-level threat indicators detected for AS27953 nodosud s.a
• Blacklist Activity: High-severity listings recorded in recent scans

No persistent malicious behavior patterns detected. The IP shows stability characteristics but with some routing inconsistencies.

---

## RELATIONSHIP GRAPH

DNS Associations

• host199.190-11-195.nodosud.com.ar (Primary hostname)
• No organizational or certificate relationships identified

---

## SUBNET NEIGHBORHOOD ANALYSIS (/24)

Subnet: 190.11.195.0/24

Abuse Density: 0

Total Siblings: 5

Risk Distribution: 0 High, 2 Medium, 2 Low

---

## RECOMMENDED ACTIONS

Based on risk profile and blacklist presence, the following security controls are recommended:

Firewall Rules

```bash

# iptables

iptables -A INPUT -s 190.11.195.199 -j DROP

# nftables

nft add rule inet filter input ip saddr 190.11.195.199 drop

# nginx

deny 190.11.195.199;

```

WAF Integration

• Cloudflare WAF: Block IP with expression `ip.src eq 190.11.195.199`
• AWS WAF: Add IP 190.11.195.199/32 to rule set with description "IPDebrief risk 40"
• pfSense: Configure firewall rule for 190.11.195.199/32

SOC Analyst Guidance

Monitor for correlation with subnet 190.11.195.0/24, particularly IP 190.11.195.104 (risk score 55). While the target IP shows no active service enumeration, the DNS blacklist presence warrants traffic filtering. No immediate incident response required; implement preventative blocking.

---

Intel Classification: Standard

Data Source: IPDebrief Automated Scanning

Analysis Methodology: Multi-source correlation with threat feed integration

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.