190.122.128.214📋 Copy

## IP Intelligence Briefing: 190.122.128.214/32

Threat Classification: High Risk (Score: 80/100)

Executive Summary

IP address 190.122.128.214 was assessed as High Risk on 2026-07-26. The address belongs to NODOSUD S.A (ASN 27953) in Argentina and presents an elevated threat profile despite no active services being detected.

Network Ownership & Registration

• Organization: NODOSUD S.A
• ASN: 27953
• Network Block: 190.122.128.0/20 (190.122.128.0 - 190.122.143.255)
• RIR: LACNIC
• Abuse Contact: Available via RDAP

Technical Profile

• DNS: host214.190-122-128.nodosud.com.ar (com.ar TLD)
• Services: No open ports detected; classified as "Firewalled / No Services"
• Tor/Proxy/VPN: Not detected
• Blacklist Status: 0 entries identified

Geolocation Validation

• Claimed Location: Córdoba, Argentina (Justiniano Posse)
• Validation Status: Failed
• RTT Anomaly: Observed RTT (165ms) fell below minimum possible RTT (232.3ms) for 11,614 km distance, indicating potentially spoofed or inaccurate geolocation data.

Threat Indicators

• Known Campaigns: None identified
• Threat Feeds: No matches
• DNSBL Lists: Listed on 4 of 8 queried lists
• Persistence: No persistent malicious activity observed

Neighborhood Analysis (190.122.128.0/24)

• Abuse Density: 0
• Classification: Clean
• Total Siblings: 18
• Active Siblings: 6
• Threat Siblings: 0
• Risk Distribution: 9 medium-risk neighbors, 8 low-risk neighbors, 0 high-risk neighbors

The subnet presents a mixed risk profile, with the target IP scoring 80 while sibling addresses show predominantly medium-risk ratings.

Relationship Graph

• Same Network: 190.122.128.0 - 190.122.143.255 (multiple entries)
• DNS Associations: host214.190-122-128.nodosud.com.ar (multiple entries)

Historical Activity

• Observation Count: 18 signals recorded
• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 0
• Persistent Malicious Indicator: Not flagged

Recommended Actions

Immediate:

• Block at perimeter firewall and WAF layers
• Increase logging verbosity for traffic analysis
• Review recent activity from this IP

Firewall Rules:

• iptables: `iptables -A INPUT -s 190.122.128.214 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 190.122.128.214 drop`
• nginx: `deny 190.122.128.214;`
• pfSense: `190.122.128.214/32`
• Cloudflare WAF: Block via expression `ip.src eq 190.122.128.214`
• AWS WAF: `Addresses: ["190.122.128.214/32"]`

Analyst Notes

The high risk score (80/100) contrasts with the subnet's clean classification and zero threat siblings. This may indicate a single anomalous address within an otherwise benign network, or the risk scoring incorporates factors beyond immediate threat activity (e.g., historical patterns, passive reconnaissance signals). The geolocation implausibility suggests potential spoofing attempts. Monitor for changes in risk profile and investigate any incoming connections from this

address.

Final Assessment

This IP warrants active monitoring and immediate blocking at network boundaries. The elevated risk score combined with geolocation validation failures and DNSBL listings suggests potential malicious activity despite the absence of confirmed campaign associations. The subnet-level cleanliness may indicate isolated misuse rather than organized infrastructure.

Priority: High

Status: Active Threat Indicator

Last Updated: 2026-07-26

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.