191.240.37.217📋 Copy

# IP Intelligence Briefing: 191.240.37.217/32

## Executive Summary

The IP address 191.240.37.217 is a Brazilian-origin address operated by MASTER S/A (ASN 28202) with a moderate risk profile (55/100). The address shows firewalled status with no active services, but exhibits concerning DNS indicators and resides within a subnet with elevated abuse activity.

## Network Ownership & Geolocation

• Organization: MASTER S/A (Master Cabo)
• ASN: 28202
• Country: Brazil (BR)
• Region: Minas Gerais (MG)
• City: Unai
• CIDR Block: 191.240.0.0/17
• RIR: LACNIC (Allocated: 2013-10-09)

## Risk Assessment

Overall Risk Score: 55/100 (Moderate Risk)

Key Risk Factors

• DNSBL Listings: 3 active listings across 8 DNSBL lists
• Operator Score: 0.1304 (Minimal classification)
• Route Stability: BGP route showing instability (isRouteStable: false)
• Service Purpose: Firewalled / No Services detected

Mitigating Factors

• Not classified as Tor exit node, known attacker, or spam source
• Zero blacklists from major threat feeds
• No open ports detected on the address
• No TLS certificates or HTTP services

## DNS Analysis

PTR Record: 191-240-37-217.mal-wr.mastercabo.com

• Domain: mastercabo.com
• SPF: Configured (true)
• DMARC: Not configured (false)
• Forward Resolution: Not confirmed

*Note: The "mal-wr" segment in the PTR hostname warrants attention as it may indicate malicious web routing.*

## Neighborhood Analysis (191.240.37.0/24)

Subnet Classification: Clean (Inherited Risk: 0)

Total Siblings: 15

Abuse Density: 20% (0.2)

Risk Distribution:

• High Risk: 3 IPs
• Medium Risk: 11 IPs
• Low Risk: 1 IP

Notable High-Risk Neighbors:

## Observation History

• Total Observations: 19 signals tracked
• Recent Activity: ASN and geolocation data observed as of 2026-06-17
• Threat Persistence: 0 days (not persistently malicious)
• Ownership Changes: 0 (stable ownership)

## Recommended Actions

Immediate

1. Increase Logging Verbosity: Monitor recent activity from this IP

2. Review DNSBL Listings: Investigate the 3 DNSBL listings and 8 total list entries

Firewall Rules (Recommended)

```bash

# iptables

iptables -A INPUT -s 191.240.37.217 -j DROP

# nftables

nft add rule inet filter input ip saddr 191.240.37.217 drop

# Cloudflare WAF

ip.src eq 191.240.37.217 → BLOCK

# AWS WAF

Addresses: 191.240.37.217/32

Description: IPDebrief risk 55

```

Monitoring Priority

• Subnet-Wide: Consider blocking or rate-limiting the entire 191.240.37.0/24 subnet due to 20% abuse density
• High-Risk Neighbors: Investigate the three IP addresses with risk scores of 80/100 in the same subnet
• PTR Analysis: Verify the "mal-wr" hostname against internal threat intelligence

## Conclusion

While 191.240.37.217 shows no active services or direct threat indicators, the combination of DNSBL listings, firewalled status, and presence within an abuse-prone subnet warrants defensive blocking and enhanced monitoring. The subnet's 20% abuse density suggests potential infrastructure abuse or misconfiguration affecting multiple addresses.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.