190.86.74.238📋 Copy

# IP Intelligence Briefing: 190.86.74.238

Classification: Moderate Risk (Score: 40/100)

Date: 2026-07-29

Analyst: IPDebrief Intelligence Team

---

## Executive Summary

IP 190.86.74.238 presents a moderate risk profile with mixed threat indicators. The address is assigned to CTE S.A. de C.V. (ASN 14754) within the 190.86.0.0/16 block. While current service enumeration shows no active ports, the IP exhibits DNSBL listings and geolocation inconsistencies that warrant monitoring. No direct attack patterns or known campaign associations were identified.

---

## Ownership & Network Profile

The IP is classified as a firewalled address with no active services detected. Service enumeration returned no open ports, TLS certificates, or HTTP titles.

---

## Threat Indicators

Actionable Finding: The IP appears on 2 DNSBL lists despite a zero blacklist count in some feeds, indicating potential reputation inconsistencies across threat intelligence sources.

---

## Geolocation Discrepancy

The IP exhibits conflicting geographic data:

• Primary geolocation: United States (La Union)
• Secondary sources: El Salvador (San Salvador, coordinates: 13.3402, -87.8415)
• GeoPlausible: False
• GeoConsensus: False

This inconsistency suggests potential hosting infrastructure mismatches or misattribution in geolocation databases.

---

## Observation History

Twelve observations recorded on 2026-07-29:

• ASN consistently identified as AS14754 (telgua)
• Organization consistently reported as CTE S.A. de C.V.
• Abuse email: moises.ferrer@claro.com.sv
• Recent scan activity detected across multiple ports
• Threat pulses detected in one observation

Temporal Analysis: No persistent malicious behavior observed. Threat observation count: 0. Ownership changes: 0.

---

## Network Relationships & Neighborhood

• Relationships: Single association to the parent network (190.86.0.0/16)
• Neighbor Analysis: Subnet 190.86.74.238/24 shows zero neighboring IPs in the immediate scan window
• Abuse Density: 0 (no elevated abuse detected in adjacent addresses)
• Risk Distribution: No high-risk neighbors identified

---

## Control Plane Assessment

The control plane shows unstable routing status despite DNSSEC validation, suggesting potential BGP instability or renumbering activity.

---

## Recommended Actions

1. Monitor DNSBL activity: Two listings indicate potential reputation issues requiring ongoing monitoring

2. Verify geolocation: Investigate US vs. SV discrepancy to determine if this indicates legitimate infrastructure or spoofing

3. Passive traffic analysis: No active services detected; consider passive traffic monitoring for anomalous patterns

4. Network-level correlation: Review parent block 190.86.0.0/16 for correlated abuse patterns

---

## Conclusion

IP 190.86.74.238 represents a moderate-risk address with infrastructure inconsistencies but no active threat indicators. The DNSBL listings and geolocation conflicts are the primary concern areas. No immediate blocking is recommended; maintain monitoring and correlate with parent network activity.

Risk Level: MODERATE

Action Required: Monitor (No immediate threat)

Priority: MEDIUM

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.