201.55.142.10📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 201.55.142.10/32

Date: 2026-07-30

Classification: HIGH RISK (Score: 80/100)

---

## EXECUTIVE SUMMARY

IP address 201.55.142.10 is assigned to ISUPER TELECOMUNICACOES INFO LTDA (ASN: 28620) in Maringá, Paraná, Brazil. The IP presents an elevated threat profile with a risk score of 80/100. While no active threat indicators were detected, the IP is listed on 4 DNSBLs and exhibits geolocation anomalies. The network segment shows minimal abuse density (0), with only one medium-risk neighbor identified.

---

## RISK ASSESSMENT

---

## NETWORK ATTRIBUTES

• Organization: ISUPER TELECOMUNICACOES INFO LTDA
• ASN: 28620
• CIDR Block: 201.55.128.0/19
• Registered RIR: LACNIC
• Network Role: Firewalled / No Services Detected
• Infrastructure Type: Not Cloud, CDN, VPN, Proxy, or Tor

---

## GEOLOCATION ANALYSIS

Reported Location: Maringá, Paraná, Brazil

Coordinates: Latitude -14.24, Longitude -51.93

Accuracy Radius: 2500 km

⚠️ GEOLOCATION ANOMALY DETECTED:

RTT measurement of 143.0ms violates the minimum possible RTT of 203.1ms for the reported 10,154 km distance. This discrepancy indicates geolocation data is unreliable. GeoPlausible validation returned false.

---

## THREAT INTELLIGENCE

Threat Indicators: None detected

Known Campaigns: None associated

Tor Exit Node: No

Known Attacker: No

Spam Source: No

Control Plane:

• Route Stability: Unstable
• Route Changes (30d): 0
• RPKI State: Not available
• DNSSEC Valid: Yes

DNSBL Status: Listed on 4 of 8 total threat feeds (abuseConfidenceScore unavailable)

---

## NEIGHBORHOOD ANALYSIS (/24: 201.55.142.0/24)

Subnet Statistics:

• Total Siblings: 5
• Active Siblings: 0
• Threat Siblings: 0
• Abuse Density: 0
• Classification: Not inherited

---

## OBSERVATION HISTORY

12 observations recorded, most recent: 2026-07-30 21:21:08 UTC. No persistent malicious activity detected. Multiple signal types observed including geolocation inference, ASN lookup, and network role classification.

---

## RECOMMENDED ACTIONS

IMMEDIATE: Monitor with increased logging verbosity (Critical Severity)

Elevated risk score (80/100) requires enhanced monitoring.

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 201.55.142.10 -j DROP

# nftables

nft add rule inet filter input ip saddr 201.55.142.10 drop

# nginx

deny 201.55.142.10;

# pfSense

201.55.142.10/32

# Cloudflare WAF

{"description":"Block 201.55.142.10 — IPDebrief risk score 80","action":"block","filter":{"expression":"ip.src eq 201.55.142.10"}}

# AWS WAF

{"Addresses":["201.55.142.10/32"],"Description":"IPDebrief risk 80"}

```

---

## ANALYST NOTES

1. DNSBL Listings: Four DNSBL entries suggest historical abuse patterns. Investigate source of listings.

2. Geolocation Discrepancy: RTT violation indicates IP may not be physically located in Brazil. Consider this when assessing threat origin.

3. No Active Services: IP appears firewalled with no open ports or TLS certificates. May indicate passive monitoring or dormant infrastructure.

4. Neighbor 201.55.142.205: Medium-risk score (55) warrants investigation as potential correlated infrastructure.

---

Status: Monitor Recommended

Priority: Critical

Confidence: High (based on risk score and DNSBL presence)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.