190.89.137.237
Threat Intelligence Briefing for IP 190.89.137.237
Date: 2026-06-08
---
**1. IP Profile**
- Risk Score: 80 (High Risk)
- Ownership: T. R. TELECOMUNICACOES LTDA (Brazilian ISP, ASN 270368)
- Geolocation: Brazil (SP, Votuporanga), Latitude: -20.48, Longitude: -50.01
- Network Role: Residential/Static IP (no services detected)
- Threat Indicators:
- Listed in 4 DNSBLs (3 high-severity entries).
- No direct malware, phishing, or campaign associations.
---
**2. Observation History**
- Recent Activity (Last 30 Days):
- DNSSEC Valid: Yes.
- Routing Stability: Unstable (route changes detected).
- DNSBL Listings: 3 high-severity entries (e.g., Spamhaus, Tor exit nodes).
- Residential Infrastructure: Confirmed (no CDN/VPN/Hosting).
- Trend: No persistent malicious activity; risk score remains stable.
---
**3. Relationships**
- Linked Entities:
- Subnet 190.89.137.0/24 (ASN 270368).
- No direct ties to known malicious organizations or campaigns.
---
**4. Subnet Analysis**
- Subnet: 190.89.137.0/24
- Abuse Density: 19% (19 high-risk IPs, 71 medium-risk IPs, 8 low-risk IPs).
- Neighbors:
- 100 total IPs in subnet.
- 19 IPs flagged as high-risk (e.g., open ports, DNSBL listings).
- 71 IPs with medium-risk scores (e.g., transient abuse, unstable routing).
---
**5. Recommendations**
- Monitor: Track DNSBL listings and subnet activity for emerging threats.
- Network Segmentation: Isolate residential IPs to prevent lateral movement.
- DNS Filtering: Block known malicious subnets (e.g., 190.89.137.0/24) using DNSBLs.
- Logging: Correlate with internal logs to detect anomalous traffic patterns.
Conclusion: This IP is residential and owned by a Brazilian ISP. While no direct threats are detected, its subnet has a moderate abuse density. SOC teams should prioritize monitoring DNSBL listings and subnet activity for potential risks.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | T. R. TELECOMUNICACOES LTDA |
| ASN | AS270368 |
| Network Name | 378879 |
| CIDR Block | 190.89.136.0/23 |
| RIR | LACNIC |
| Country | BR |
| Abuse Contact | — |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Residential |
| Service Purpose | Web Server |
| Network Tier | End-User — Residential ISP endpoint |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| Closed Ports | 22, 25, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | lighttpd/1.4.39 |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 25% | 1 | 1 |
| routing | 25% | 1 | 1 |
| services | 13% | 1 | 1 |
| ownership | 24% | 2 | 2 |
| reputation | 17% | 1 | 1 |
| geolocation | 27% | 2 | 2 |
| Overall | 22% | 8 | 8 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-18 15:26:04 UTC |
| Last Seen | 2026-06-08 14:25:07 UTC |
| Profile Built | 2026-06-08 14:50:42 UTC |
| Data Freshness | Live |
| Signal Types | 15 |
| Total Observations | 20 |
Full dossier details are available via our API.