190.12.83.134📋 Copy

# IP Intelligence Briefing: 190.12.83.134

## Executive Summary

IP 190.12.83.134 presents as a high-risk web server (Risk Score: 80) operating within a Peruvian ASN but geolocated to Taiwan. The IP exhibits mixed geolocation signals and maintains presence on multiple DNS blacklists. No active threat indicators or known campaigns were identified, but the IP warrants monitoring due to its risk profile and control plane instability.

---

## Technical Profile

Ownership & Network Context

• ASN: 27843 (RENA WARE DEL PERU)
• Network Block: 190.12.83.128/29
• Organization: RENA WARE DEL PERU
• RIR: LACNIC
• Classification: Web Server / Infrastructure

Geolocation Discrepancy

• Primary Location: Taipei, Taiwan (TW)
• ASN Registration: Peru
• Multiple geo sources indicate conflicting positioning with consensus flag enabled
• Geoplausible: False (validation concerns)

Service Fingerprint

• Open Ports: 80/TCP (HTTP), 443/TCP (HTTPS), 22/TCP (SSH)
• Web Server: Apache/2.4.17 (Unix)
• Backend: PHP/5.5.30 (legacy version)
• SSL Certificate: FortiWAN, O=Fortinet, S=Taipei, C=TW

---

## Threat Assessment

Risk Indicators

• Risk Score: 80 (High Risk)
• DNSBL Listings: 5 of 8 total lists
• Operator Score: 0.1304 (Minimal)
• Route Stability: False (instability detected)
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No

Historical Observations

• Total Signals: 18 observations
• Recent Activity: 2026-07-27
• Threat Persistence: None detected
• One observation flagged ASN 27843 with `has_threats: true` and 9 pulses in AlienVault OTX

Control Plane Analysis

• BGP Prefix: 190.12.82.0/23
• Route Changes (30d): 0
• RPKI State: Not evaluated
• DNSSEC Valid: True

---

## Neighborhood Analysis

• Subnet: 190.12.83.134/24
• Abuse Density: 0 (clean classification)
• Active Siblings: 0
• Threat Siblings: 0
• Inherited Risk: 0

The immediate /24 subnet shows no abuse density, but the /29 block contains only this single IP.

---

## Relationships

• Same Network: 190.12.83.128 - 190.12.83.135 (internal network block)
• No external entity relationships (organizations, hostnames, certificates)

---

## Security Recommendations

Immediate Actions

1. Block SSH (port 22) from untrusted sources if not required for legitimate access

2. Monitor for abuse - DNSBL presence indicates prior reputation issues

3. Validate SSL certificate chain and verify Fortinet certificate authenticity

4. Review Apache/PHP version - Apache 2.4.17 and PHP 5.5.30 are significantly outdated

Firewall Rules

```bash

# Block SSH from non-admin networks

iptables -A INPUT -p tcp --dport 22 -j DROP

# Rate limit HTTP/HTTPS traffic

iptables -A INPUT -p tcp --dport 80,443 -m limit --limit 10/minute -j ACCEPT

```

Threat Intelligence Notes

• Geographic mismatch between ASN registration (Peru) and geolocation (Taiwan) warrants investigation
• Legacy PHP 5.5.30 is vulnerable to multiple CVEs (CVE-2019-11043, CVE-2020-5081)
• DNSBL listings suggest prior spam or abuse activity
• Route instability may indicate infrastructure issues or hijacking attempts

Monitoring Priorities

• Track for new DNSBL additions
• Monitor for port scanning activity
• Observe for changes in geolocation signals
• Alert on any threat indicator emergence

---

*Report generated: Current timestamp*

*Intel Source: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.