190.218.89.95📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 190.218.89.95/32

Classification: Residential Endpoint

Risk Score: 40/100 (Moderate Risk)

Date: Intelligence compiled from IPDebrief platform data

## EXECUTIVE SUMMARY

IP address 190.218.89.95 is a residential cable endpoint belonging to Cable Onda (ASN 18809). The asset carries a moderate risk profile with conflicting geolocation indicators and limited threat indicators. Network classification identifies this as a residential cable connection, not cloud, hosting, or proxy infrastructure.

## OWNERSHIP AND INFRASTRUCTURE

## GEOLOCATION DISCREPANCY ALERT

Conflicting geolocation data detected across observation sources:

• Primary Classification: Miami, Florida, US
• Alternative Source: David, Chiriquí Province, Panama (PA)
• Status: GeoConsensus = FALSE (2 sources disagree)

This discrepancy may indicate routing anomalies, NAT translation issues, or geolocation database inconsistencies. Recommend correlation with traffic flow data for accurate positioning.

## THREAT INDICATORS

• Blacklist Count: 0
• DNSBL Listed: 2 of 8 total lists
• Known Attacker Status: FALSE
• Tor Exit Node: FALSE
• Spam Source: FALSE
• Campaign Correlation: None detected
• Threat Persistence Days: 0

## NETWORK BEHAVIOR

• Open Ports: None detected
• DNS PTR: cpe-00016cf99a68.cpe.cableonda.net
• Forward Resolution: 1 hostname confirmed
• HTTP/TLS Services: Not detected
• Certificate Associations: None

## NETWORK NEIGHBORHOOD ANALYSIS

Subnet: 190.218.89.95/24

Abuse Density: 0

Threat Siblings: 0

Classification: Clean

Active Siblings: 0

The /24 subnet shows no correlated threat activity from neighboring addresses.

## OBSERVATION HISTORY

Total observations: 17

• Recent signals (2026-07-24) confirm residential cable classification
• No ownership changes detected
• No persistently malicious activity patterns
• Threat observation count: 0

## RELATIONSHIP MAPPING

1. Same Network: 190.218.0.0 - 190.218.255.255/16

2. DNS Association: cpe-00016cf99a68.cpe.cableonda.net

No organizational, certificate, or infrastructure relationships detected beyond immediate network and DNS mappings.

## RECOMMENDED ACTIONS

Given the moderate risk score of 40, the following defensive measures are recommended:

Firewall Rules

```bash

# iptables

iptables -A INPUT -s 190.218.89.95 -j DROP

# nftables

nft add rule inet filter input ip saddr 190.218.89.95 drop

# nginx

deny 190.218.89.95;

# pfSense

190.218.89.95/32

```

Cloud Platforms

• Cloudflare WAF: Block with expression `ip.src eq 190.218.89.95`
• AWS WAF: Add IP set with address `190.218.89.95/32`

## ANALYST NOTES

1. Risk Context: Risk score 40 indicates moderate concern. While no active threat indicators exist, the DNSBL listings (2 of 8) warrant monitoring.

2. Geolocation Discrepancy: The Miami, US vs Panama conflict requires investigation. Traffic flow analysis or reverse path filtering data may clarify actual routing path.

3. Residential Classification: As a residential cable endpoint, this IP may be used for legitimate purposes but could also be compromised for botnet activity or spam operations.

4. Subnet Context: Clean neighborhood assessment suggests this is an isolated risk rather than part of a larger attack infrastructure.

5. Monitoring Recommendation: Add to watchlist for emerging threat indicators. No immediate blocking required unless specific threat activity is observed.

---

*Intelligence compiled from IPDebrief platform. Recommendations are probabilistic and should be combined with additional signals before operational action.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.