200.121.203.152📋 Copy

# IP INTELLIGENCE BRIEFING

Subject: 200.121.203.152/32

Date: Current

Classification: Moderate Risk

## EXECUTIVE SUMMARY

IP 200.121.203.152 presents a moderate risk profile (55/100) with evidence of blacklist listings and rate-limit activity. The IP is associated with Peruvian ISP Integratel Peru S.A.A. (AS6147) but exhibits geographic discrepancies with US-based geolocation. No active services detected; network appears firewalled.

## RISK PROFILE

## OWNERSHIP & GEOGRAPHY

ASN: 6147 (INTEGRATEL PERU S.A.A.)

Country: US (Peruvian ISP registry)

CIDR Block: 200.121.203.0/24

Geolocation: New York, US (US-NY)

Registration: 2004-05-07 (LACNIC)

*Note: Geographic discrepancy between Peruvian ISP assignment and US-based geolocation warrants monitoring for potential misconfiguration or dual-use infrastructure.*

## NETWORK STATUS

Services: None detected (Firewalled / No Services)

Open Ports: 0

DNS Resolution: client-200.121.203.152.speedy.net.pe

PTR Record: client-200.121.203.152.speedy.net.pe

Forward Resolution: 1 hostname (net.pe domain)

## OBSERVATION HISTORY (13 Signals)

Recent observations include:

• HTTP 429 rate limit response (2026-07-25T06:44:47)
• Multiple blacklist listings with HIGH severity (2026-07-25T06:42:28)
• DNSSEC validation confirmed (true)
• ASN attribution via team-cymru-dns source

## NEIGHBORHOOD ANALYSIS

Subnet: 200.121.203.0/24

Abuse Density: 0

Active Siblings: 0

Threat Siblings: 0

No correlated threat activity detected in adjacent /24 subnet.

## RELATIONSHIP GRAPH

Single DNS hostname association; no organizational or certificate relationships identified.

## RECOMMENDED ACTIONS

IMMEDIATE

1. Block Traffic: Implement firewall rules to drop all traffic from 200.121.203.152

2. Increase Logging: Monitor recent activity patterns with enhanced verbosity

FIREWALL RULES

```bash

# iptables

iptables -A INPUT -s 200.121.203.152 -j DROP

# nftables

nft add rule inet filter input ip saddr 200.121.203.152 drop

# Cloudflare WAF

{"description":"Block 200.121.203.152 — IPDebrief risk score 55","action":"block"}

# AWS WAF

{"Addresses":["200.121.203.152/32"],"Description":"IPDebrief risk 55"}

```

MONITORING

• Track blacklist status changes
• Monitor for new service openings
• Watch for subnet-wide activity patterns

## INTELLIGENCE NOTES

• IP exhibits rate-limit behavior (HTTP 429) suggesting automated probing or abuse attempts
• Geographic mismatch between ISP registry (Peru) and geolocation (US) may indicate proxy usage or misconfiguration
• Low neighborhood abuse density suggests isolated threat actor or compromised endpoint
• No persistent malicious behavior detected; risk driven by blacklist listings and rate-limit signals

---

*Report generated via IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.