2.99.211.44📋 Copy

# IP INTELLIGENCE BRIEFING: 2.99.211.44

Classification: MODERATE RISK — Mobile Residential Connection with DNSBL Listings

## Executive Summary

IP address 2.99.211.44 is a moderate-risk (65/100) residential mobile connection associated with O2/Telefonica UK Ltd. The IP terminates in the OPAL-DSL-NPE001-SLO-004 network block (2.99.208.0/21), geolocated to Dewsbury, England. No active services are detected, but the IP is listed on 3 of 8 DNS blacklists, indicating prior abuse activity.

## Technical Profile

Ownership & Registration:

• ASN: 13285 (TALKTALK-MNT)
• Organization: OPAL-DSL-NPE001-SLO-004
• CIDR Block: 2.99.208.0/21 (RIPE NCC)
• Registration: RIR: RIPE

Geolocation:

• Country: United Kingdom (GB)
• Region/City: England, Dewsbury
• Coordinates: 55.38°N, -3.44°W (multi-signal inference, 500km accuracy)
• RTT Metrics: Avg 104.2ms, Min 103ms, Max 106ms (5 probes)

Network Classification:

• Connection Type: Mobile (LTE/5G)
• Carrier: O2 / Telefonica UK Ltd (MCC: 234, MNC: 10)
• Infrastructure: Not CDN, Cloud, VPN, Proxy, or Hosting
• Services: Firewalled / No Services (open ports: none)

DNS Resolution:

• PTR Hostname: host-2-99-211-44.as13285.net
• Forward Resolution: Confirmed
• Domain: as13285.net
• Email Authentication: SPF: No, DMARC: No
• TXT Records: 0

Control Plane:

• BGP Origin: 2.96.0.0/14
• Operator Score: 0.2609 (Basic)
• DNSSEC: Valid
• Route Stability: Unstable (isRouteStable: false)

## Threat Indicators

Risk Assessment:

• Overall Risk Score: 65 (Moderate)
• Abuse Confidence Score: Not available
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False

Blacklist Status:

• DNSBL Listed: 3 out of 8 lists
• Known Campaigns: None identified
• Cert Matches: 0

Network Neighborhood (2.99.211.0/24):

• Subnet Classification: Mostly Clean
• Abuse Density: Low (1)
• Threat Siblings: 1 active threat IP detected in subnet
• Total Siblings: 1

Services:

• No open ports detected
• No TLS certificates
• No HTTP services
• No server banners

## Observation History

Temporal Analysis:

• Total Observations: 21 signals recorded
• Most Recent: 2026-07-30
• Ownership Changes: 0 (stable ownership)
• Threat Persistence: Not persistently malicious
• Threat Observation Count: 1

Recent Signal Types:

• Geolocation validation (confidence: 0.75)
• Ownership verification (confidence: 0.85)
• Subnet analysis (confidence: 0.40)
• Mobile geolocation inference (confidence: 0.52)
• Port scanning results (confidence: 0.70)

## Relationship Graph

Associated Entities:

• Network: OPAL-DSL-NPE001-SLO-004 (repeated associations)
• Hostname: host-2-99-211-44.as13285.net (DNS associations)
• Network Type: Residential mobile broadband

## Recommended Actions

Based on the moderate risk profile and DNSBL listings, the following firewall rules are recommended:

Ingress Filtering:

```

# Block known malicious sources (adjust based on specific threat intelligence)

iptables -A INPUT -s 2.99.211.44 -j DROP

# Monitor traffic from residential mobile ranges

iptables -A INPUT -s 2.99.208.0/21 -j LOG --log-prefix "RESIDUAL-MOBILE: "

```

Egress Controls:

• Implement rate limiting for mobile IP ranges
• Monitor for DNS queries to high-risk TLDs
• Consider geolocation-based access restrictions for sensitive systems

Monitoring:

• Track DNSBL listing changes
• Monitor for service appearance on previously closed ports
• Watch for subnet-wide threat escalation

## Risk Mitigation

1. Short-term: Monitor for service emergence and DNSBL list additions

2. Medium-term: Implement geolocation-based access controls for sensitive assets

3. Long-term: Consider blocking entire mobile carrier ranges if threat volume increases

---

Report Generated: 2026-07-30

Data Sources: IPDebrief Intelligence Platform

Classification: DEFENSIVE SECURITY INTELLIGENCE

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.