190.89.137.211📋 Copy

IP Intelligence Briefing: 190.89.137.211

*Generated using IPDebrief Threat Intelligence*

---

**1. Core Profile**

• Risk Score: 55 (Moderate Risk)
• Ownership:

- ISP: T. R. Telecomunicações Ltda (AS270368)

- Country: Brazil (BR)

- Region: São Paulo (SP)

- City: Votuporanga

• Geolocation:

- Plausibility: Low (RTT inconsistencies for distance)

- Coordinates: Latitude -14.24, Longitude -51.93 (2500km accuracy)

• Network Role: Residential web server (lighttpd/1.4.39)
• Services:

- Open ports: 80 (HTTP), 443 (HTTPS)

- No TLS certificate detected

---

**2. Threat & Behavior**

• Threat Indicators:

- No malware, spam, or attacker campaigns detected.

- No DNSBL listings or known malicious activity.

• Observations (30d):

- Scanned on 2026-06-02 (ports 80/443 open, lighttpd banner).

- Residential classification (2026-06-17).

- Geo validation anomalies (RTT vs. distance).

---

**3. Network Relationships**

• Subnet: 190.89.136.0/23 (T. R. Telecomunicações Ltda)
• Neighbors:

- Total: 100 IPs in /24 subnet.

- Abuse Density: 17% (17 high-risk, 77 medium-risk, 6 low-risk).

- High-Risk Neighbors: 17 (e.g., IPs with similar risk scores).

---

**4. Actionable Insights**

• SOC Recommendations:

- Monitor for unexpected traffic spikes or port changes.

- Validate geolocation anomalies (RTT discrepancies).

- Consider blocking high-risk neighbors (e.g., IPs with 55+ risk scores) to mitigate subnet-level threats.

• Threat Context:

- Residential IPs are often targets for credential stuffing or DDoS.

- No direct malicious activity, but subnet abuse density suggests indirect risk.

---

Conclusion: 190.89.137.211 is a residential web server with no direct threat indicators, but its subnet contains notable risk. Prioritize monitoring for behavioral changes and consider subnet-level mitigation strategies.

*Generated by IPDebrief Threat Intelligence*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.