209.87.164.222📋 Copy

# IP Intelligence Briefing: 209.87.164.222/32

Classification: Low Risk / Defensive Monitoring Recommended

## Executive Summary

IP 209.87.164.222 is a low-risk residential IP address within the 209.87.164.0/24 subnet. The address shows no active threat indicators, no open services, and maintains a clean neighborhood classification. Risk score of 25 indicates minimal threat profile.

## Network Profile

• ASN: 396356
• Organization: Private Customer
• CIDR Block: 209.87.164.0/24
• RIR: ARIN
• Geolocation: United States (coordinates: 39.83, -98.58)
• Network Role: Firewalled / No Services
• Classification: Residential (non-datacenter)

## Threat Assessment

Current Risk Score: 25 (Low)

Threat Indicators:

• Blacklist count: 0
• Known campaigns: None
• Threat feeds: No matches
• Abuse confidence: Not elevated
• Is Tor exit/VPN/Proxy/CDN: False
• Is hosting provider: False

DNSBL Status: Listed on 1 of 8 total DNSBLs checked (DNSBL listed count: 1)

## Behavioral Observations

Services: No open ports detected

DNS: No PTR records, no forward resolution, no hosted domains

Email: No SPF/DMARC records configured

HTTP: No services responding on standard ports

Temporal Signals (13 observations):

• Ownership changes: 0
• Threat persistence days: 0
• Threat observation count: 0
• Persistently malicious: False

## Neighborhood Analysis

Subnet: 209.87.164.0/24

• Abuse density: 0 (clean)
• Inherited risk: 0
• Total siblings: 1
• Threat siblings: 0
• Active siblings: 0

## Network Connectivity

• Hop count: 17
• First hop RTT: 0.1ms
• Last hop RTT: 62.8ms
• Timed out hops: 3
• Transit network: Comcast
• Route stability: False (routing changes detected)
• DNSSEC: Valid
• RPKI: Not validated

## SOC Actionable Intelligence

Recommended Actions:

1. Monitor: Add to passive monitoring list due to residential classification and low-risk profile

2. No blocking required: Current risk score (25) and lack of threat indicators support allowing traffic

3. Geolocation validation: Coordinate with geolocation providers to verify US/39.83,-98.58 positioning

4. Route monitoring: Investigate route stability issues (isRouteStable: false) - may indicate infrastructure changes

Firewall Rules:

• No immediate blocking or filtering required
• Consider geographic filtering if policy mandates US-only traffic
• Monitor for service openings on previously closed ports

Relationships:

• Single network association (NET-209-87-164-0-24)
• No certificate or hostname associations detected
• No correlated malicious IPs identified

Conclusion: This IP presents minimal threat risk and should not be blocked without additional context. Standard monitoring protocols are sufficient. No immediate defensive action required.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.