200.229.252.75📋 Copy

# IP Intelligence Briefing: 200.229.252.75/32

Classification: Moderate Risk

Date: Current Analysis

---

## Executive Summary

IP address 200.229.252.75 is assigned to ASN 52465 (Carcamo German Rodrigo) and geolocates to Rosario, Argentina (AR). The asset presents a moderate risk profile (score: 55/100) with no active threat indicators detected. The IP operates in a subnet exhibiting mixed classification characteristics with elevated abuse density. No services or open ports were detected during analysis.

---

## Technical Profile

---

## Neighborhood Analysis

The 200.229.252.0/24 subnet demonstrates elevated activity patterns:

• Abuse Density: 0.375 (moderate)
• Total Subnet Siblings: 8
• Active Siblings: 3
• Threat Siblings: 3
• Risk Distribution: 7 medium-risk neighbors, 0 high-risk neighbors

Notable adjacent IPs with elevated risk scores include:

• 200.229.252.72 (Risk: 70)
• 200.229.252.73 (Risk: 55)
• 200.229.252.79 (Risk: 55)

The subnet's mixed classification suggests legitimate and potentially compromised endpoints coexist within the same address block.

---

## Observation History

Analysis of signal history reveals 19 observations across the monitoring period. Key temporal signals include:

• 2026-06-25: Multiple signal observations recorded with confidence levels ranging from 0.20 to 0.52
• 2026-06-04: Geolocation inference confirmed Argentina (AR) with 52% confidence

The IP demonstrates threat persistence of 0 days and is not classified as persistently malicious.

---

## Network Relationships

Relationship mapping identifies 12 connections, all representing same-network relationships to the 200.229.252.0/24 range (200.229.252.0 - 200.229.255.255). No external organization, hostname, or certificate relationships were detected.

---

## Control Plane Assessment

• Origin ASN: 52465
• BGP Prefix: 200.229.252.0/24
• RPKI State: Not available
• Route Stability: False
• DNSSEC Valid: True
• DNSBL Listed: 3 of 8 total lists

---

## Recommended Actions

Based on the elevated risk score (55/100), the following security actions are recommended:

Monitoring

• Increase logging verbosity for traffic from this IP
• Review recent activity patterns within the subnet

Firewall Rules

iptables:

```

iptables -A INPUT -s 200.229.252.75 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 200.229.252.75 drop

```

nginx:

```

deny 200.229.252.75;

```

pfSense:

```

200.229.252.75/32

```

Cloudflare WAF:

```json

{

"description": "Block 200.229.252.75 — IPDebrief risk score 55",

"action": "block",

"filter": {

"expression": "ip.src eq 200.229.252.75"

}

}

```

AWS WAF:

```json

{

"Addresses": ["200.229.252.75/32"],

"Description": "IPDebrief risk 55"

}

```

---

## Assessment Notes

The IP address presents moderate risk due to its presence in a subnet with mixed abuse characteristics. While no direct threat indicators were detected for this specific IP, the neighborhood context suggests potential lateral risk. Recommended action is to implement monitoring and consider blocking based on organizational risk tolerance thresholds.

Analyst Note: This assessment is based on automated intelligence gathering. Correlate with internal telemetry before implementing blocking measures.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.