190.143.242.67📋 Copy

# IP Intelligence Briefing: 190.143.242.67/32

## Executive Summary

IP address 190.143.242.67 presents a moderate risk profile (score: 40) with no active malicious indicators. The IP is geolocated to Newark, NJ but resolves to a Nigerian domain, with DNSBL listings and failed geo-validation. No open services were detected; the host appears firewalled.

## Risk Assessment

• Overall Risk Score: 40 (Moderate Risk)
• Provider Score: 0 (No provider data available)
• Authority Score: 0
• Stability: No ownership changes detected; threat persistence days: 0
• Persistence Classification: Not persistently malicious

## Geolocation & Network Context

• Location: Newark, New Jersey, US (US-NJ)
• Region: America/New_York timezone
• Geolocation Confidence: Low (2 sources, consensus: false, geoPlausible: false)
• Control Plane: Origin ASN 28036, BGP prefix 190.143.242.0/24
• Route Stability: False (route changes observed)
• DNSSEC: Valid
• Traceroute: 30 hops, 16 timeouts, transit via Comcast

## DNS & Hostname Analysis

• PTR Record: host67-242-143-190.tigobusiness.com.ni
• Forward Resolution: Confirmed
• Hosted Domains: 0
• Email Authentication: SPF: false, DMARC: false
• DNSBL Listings: 2 out of 8 total lists
• Anomaly: Nigerian .ni TLD with US geolocation suggests infrastructure misconfiguration or foreign hosting

## Service Profile

• Open Ports: None detected
• Service Classification: Firewalled / No Services
• TLS Certificate: None
• HTTP Banner: None
• WAF Violations: 0
• Honeypot Hits: 0

## Threat Indicators

• Known Attacker: false
• Spam Source: false
• Tor Exit Node: false
• Proxy/VPN/CDN/Cloud: false
• Abuse Confidence Score: null
• Known Campaigns: None
• Blacklist Count: 0 (despite DNSBL presence)
• Threat Feeds: None

## Neighborhood Analysis (190.143.242.0/24)

• Subnet Abuse Density: 0 (Low)
• Total Siblings: 2
• Active Siblings: 2
• Threat Siblings: 0
• Neighbor Risk Scores:

- 190.143.242.148: Risk 0, Authority 50

- 190.143.242.182: Risk 25, Authority 60

## Historical Observations

• Total Observations: 15
• Most Recent: 2026-07-23
• Signal Types: Network role, ownership, HTTP errors (429), operator score, profile dimensions
• Threat Observation Count: 0
• Key Finding: Recent HTTP 429 responses observed, suggesting rate limiting or automated interaction

## Relationships

• DNS Associations: 4 entries, all pointing to host67-242-143-190.tigobusiness.com.ni
• No additional relationships: No organizations, certificates, or related IPs detected

## Recommended Actions

Current Risk Score: 40

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 190.143.242.67 -j DROP

# nftables

nft add rule inet filter input ip saddr 190.143.242.67 drop

# nginx

deny 190.143.242.67;

# pfSense

190.143.242.67/32

# Cloudflare WAF

{"description":"Block 190.143

---

AWS WAF:

```json

{

"Addresses": ["190.143.242.67/32"],

"Description": "IPDebrief risk 40"

}

```

## Threat Intelligence Narrative

The target IP 190.143.242.67 exhibits moderate risk characteristics with no confirmed malicious activity. Key indicators include DNSBL listings (2 of 8 lists), failed geolocation validation (US location vs. .ni Nigerian domain), and route instability within the 190.143.242.0/24 subnet. The absence of open ports and services indicates the host is either actively firewalled or functioning as infrastructure rather than an endpoint.

Historical observation data shows 15 total signals collected as of July 2026, with HTTP 429 responses detected, suggesting rate-limiting behavior or automated probing attempts. The subnet contains 2 active neighbors with low-to-moderate risk scores, indicating limited lateral threat activity.

## SOC Analyst Guidance

Monitor for:

• Increased DNSBL listings
• New open ports or service banners
• Correlated IP activity from neighbors 190.143.242.148 or 190.143.242.182
• Changes in geolocation confidence

Action Thresholds:

• Risk Score > 50: Consider blocking
• Risk Score 40-50: Monitor with logging enabled
• Risk Score < 30: Allow with standard inspection

Recommendation: Implement the recommended firewall rules if traffic patterns warrant. The moderate risk score combined with geographic inconsistency suggests potential infrastructure misconfiguration or low-level abuse capability, but no active threats were detected in the observation window.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.