209.99.189.190
## IP INTELLIGENCE BRIEFING: 209.99.189.190
Classification: Moderate Risk (Score: 40) | Jurisdiction: Switzerland (CH) | ASN: 402253
---
OWNERSHIP & INFRASTRUCTURE
The IP address 209.99.189.190 belongs to SKN Subnet & Telecom Ltd (SSTL-49) within CIDR block 209.99.184.0/21. Geographic positioning indicates Zurich, Switzerland (47.36°N, 8.54°E) with geovalidation confidence. Network classification identifies this as a residential endpoint with single-service host designation.
NETWORK SERVICES & EXPOSURE
Active services reveal open TCP port 22 (SSH) running OpenSSH_8.4p1 Debian-5+deb11u6. No TLS certificates, HTTP content, or reverse DNS records are present. Forward resolution failed. The endpoint shows no CDN, cloud, proxy, or hosting characteristics.
THREAT INDICATORS
No active threat indicators detected. The IP is not classified as a Tor exit node, known attacker, or spam source. Zero blacklist entries and no campaign correlations observed. DNSBL listing present on 2 of 8 evaluated lists. RPKI status and IRR consistency data unavailable.
SUBNET CONTEXT
The /24 subnet (209.99.189.0/24) demonstrates moderate abuse density at 0.2. Of 11 sibling addresses, 7 remain active. Risk distribution shows 2 high-risk neighbors (scores: 209.99.189.145, 209.99.189.177), 2 medium-risk, and 4 low-risk. Target IP shows zero inherited threat signals from neighborhood.
TEMPORAL ANALYSIS
Observation history contains 13 signals through 2026-07-30. No ownership changes recorded. Threat persistence days and observation count both report zero. Classification has remained stable as residential with clean subnet designation.
---
RECOMMENDED ACTIONS
Risk Score: 40/100 — Block recommended for defensive posture.
Firewall Rules:
- `iptables -A INPUT -s 209.99.189.190 -j DROP`
- `nft add rule inet filter input ip saddr 209.99.189.190 drop`
- `nginx deny 209.99.189.190;`
- `Cloudflare WAF: Block — Expression: ip.src eq 209.99.189.190`
- `AWS WAF: 209.99.189.190/32`
Assessment: While the IP lacks direct malicious indicators, the combination of residential classification, open SSH port, and DNSBL presence warrants blocking. Monitor for lateral activity from high-risk neighbors 209.99.189.145 and 209.99.189.177.
---
*Generated: IPDebrief Threat Intelligence Platform*
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | SKN Subnet & Telecom Ltd |
| ASN | AS402253 |
| Network Name | SSTL-49 |
| CIDR Block | 209.99.184.0/21 |
| RIR | ARIN |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Residential |
| Service Purpose | Single-Service Host |
| Network Tier | End-User — Residential ISP endpoint |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 22 | ssh | tcp | |
| Closed Ports | 25, 80, 443, 3389, 8080, 8443 (1 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
| SSH Version | SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u6 |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 25% | 1 | 1 |
| routing | 25% | 1 | 1 |
| services | 25% | 1 | 1 |
| ownership | 0% | 0 | 0 |
| reputation | 0% | 0 | 0 |
| geolocation | 0% | 0 | 0 |
| Overall | 12% | 3 | 3 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-27 03:36:04 UTC |
| Last Seen | 2026-08-13 00:40:08 UTC |
| Profile Built | 2026-07-30 10:46:06 UTC |
| Data Freshness | Live |
| Signal Types | 15 |
| Total Observations | 15 |
Full dossier details are available via our API.