190.110.49.17📋 Copy

## IP Intelligence Briefing: 190.110.49.17

Classification: Moderate Risk (Score: 65)

Date: 2026-07-30

Analysis Type: Threat Intelligence Assessment

---

Ownership & Network Infrastructure

The IP address 190.110.49.17 belongs to PUNTONET S.A. (ASN 22724), a LACNIC-registered entity operating the 190.110.48.0/21 block (190.110.48.0 - 190.110.55.255). The network registration is associated with Guayaquil, Guayas, Ecuador. Forward DNS resolution confirms the hostname corp-190-110-49-17.punto.net.ec with no email authentication records (SPF/DMARC not configured).

Risk Assessment

The IP registers a risk score of 65 (Moderate Risk) with no threat indicators detected. No known campaigns, blacklists, or campaign correlations were identified. The IP is not classified as Tor exit node, known attacker, spam source, or hosting service. No open ports or services are accessible. The control plane shows the IP is not route-stable (isRouteStable: false) and is listed on 3 of 8 DNSBLs.

Geolocation Validation

Geolocation data shows Ecuador (Guayaquil) with coordinates -2.2, -79.88, but this is flagged as implausible. Probing indicates a 111ms round-trip time versus a minimum possible 199.3ms for the claimed 9,965km distance, suggesting inaccurate geolocation data.

Neighborhood Analysis

The /24 subnet (190.110.49.0/24) exhibits zero abuse density with no detected threat siblings. Only one active sibling exists within the subnet. The neighborhood risk profile is clean, with no inherited risk flags.

Historical Observations

Sixteen observations were recorded as of 2026-07-30. The IP shows no persistent malicious behavior (threatPersistenceDays: 0) and no ownership changes. Signals indicate consistent classification as "clean" with zero threat siblings across the observation period.

Related Entities

DNS relationships map the IP to corp-190-110-49-17.punto.net.ec. No additional organizations, certificates, or correlated IPs were identified in the relationship graph.

---

Assessment Summary

IP 190.110.49.17 presents a moderate risk profile with no active threat indicators. The risk score of 65 likely reflects the DNSBL listings (3 of 8) rather than active malicious activity. The geolocation data appears unreliable, requiring external validation. No immediate firewall action is recommended beyond standard blocking of the DNSBL-listed IP. The subnet environment is clean with no neighbor threats.

Recommendation: Monitor for changes in DNSBL listings and geolocation accuracy. No active threat response required.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.