190.181.87.95📋 Copy

# IP Intelligence Briefing: 190.181.87.95/32

Classification: Moderate Risk | Report Date: Current

Analyst: IPDebrief Intelligence Team

---

## Executive Summary

IP address 190.181.87.95 presents a moderate risk profile (score: 55/100) with no evidence of active malicious behavior. The IP is assigned to MicrolanOeste.net srl (AS52251) and geolocated to Merlo, Buenos Aires, Argentina. Network role classification indicates the IP is firewalled with no active services. While the immediate threat indicators are low, the IP resides in a subnet with elevated abuse density (6.2%), warranting enhanced monitoring.

---

## Technical Profile

---

## Neighborhood Risk Assessment (190.181.87.0/24)

The /24 subnet contains 17 sibling IPs with the following risk distribution:

• High Risk: 1 IP (190.181.87.211, risk score: 80)
• Medium Risk: 6 IPs (including 190.181.87.5, .43, .65, .66, .74 at score 55)
• Low Risk: 9 IPs

Abuse Density: 6.2% (1 threat sibling identified)

Active Siblings: 7

The elevated abuse density in this subnet suggests coordinated or adjacent malicious activity. While 190.181.87.95 shows no direct threat indicators, proximity to high-risk neighbors increases contextual risk.

---

## Historical Observations

Sixteen signal observations recorded. Key findings:

• Recent subnet classification: "mostly_clean" (5.88% abuse density)
• ASN AS52251 flagged with 1 threat pulse via AlienVault OTX
• Geolocation confidence moderate (0.52) with multi-signal inference
• No persistent malicious behavior detected
• Ownership changes: 0 (stable)

---

## Relationship Graph

No external entity relationships detected beyond same-network associations. The IP is not associated with known hostnames, organizations, or SSL certificates.

---

## Recommended Security Actions

Priority: Monitor

Rationale: Elevated risk score (55/100) with subnet context suggesting potential coordinated abuse.

Actions:

1. Increase logging verbosity for this IP and monitor recent activity patterns

2. Implement blocking rules across perimeter defenses (see below)

Firewall Rules

---

## Intelligence Conclusion

190.181.87.95 does not exhibit active malicious indicators but operates within a subnet showing elevated abuse density. The absence of open services, Tor association, or known campaign links reduces immediate threat level. However, the moderate risk score and subnet context recommend defensive blocking and enhanced logging. SOC analysts should monitor for pattern changes and consider broader subnet-level monitoring for 190.181.84.0/22.

Threat Level: Moderate

Action Required: Implement block rules and increase monitoring

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.