209.99.190.112📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

IP Address: 209.99.190.112/32

Date: Current Assessment

Classification: Low Risk

## Executive Summary

IP 209.99.190.112 presents as a low-risk endpoint with a reputation score of 25/100. The address is firewalled with no active services detected. While the IP itself shows minimal threat indicators, the /24 subnet demonstrates elevated abuse density (0.2) with one high-risk neighbor (209.99.190.200, risk score 80).

## Risk Profile

• Overall Risk Score: 25 (Low Risk)
• Provider Score: 0
• Authority Score: 0
• Stability Score: 0
• Classification: Firewalled / No Services

## Ownership & Registration

• ASN: 402253 (SKN-NETWORK-1 - SKN Subnet & Telecom Ltd, KN)
• BGP Prefix: 209.99.184.0/21
• Geolocation: United States, Massachusetts, Boston
• Control Plane: Route stable with no route changes in 30 days

## Network Characteristics

• Open Ports: None
• DNSSEC: Valid
• DNSBL Listings: 1 of 8 total lists
• Blacklist Severity: High (on listed feeds)
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

## Neighborhood Analysis (209.99.190.0/24)

• Total Neighbors: 5
• Abuse Density: 0.2
• Risk Distribution: 1 High, 1 Medium, 3 Low
• Notable High-Risk Neighbor: 209.99.190.200 (Risk Score: 80)
• Notable Medium-Risk Neighbor: 209.99.190.113 (Risk Score: 65)

## Threat History

• Total Observations: 9
• Threat Persistence: 0 days (not persistently malicious)
• Recent Signals:

- DNSSEC validation confirmed (2026-07-22)

- ASN allocation: 209.99.184.0/21 allocated 2026-04-07

- Multiple DNSBL listings with high severity

• Geographic Consensus: Yes (US-MA)

## Relationship Intelligence

• Linked Entities: None detected
• Associated Hostnames: None
• Certificates: None
• Subnets: None

## Recommended Actions

No automated firewall rules or WAF recommendations generated. The low risk score (25) and absence of active threat indicators suggest standard monitoring is appropriate. However, the subnet-level abuse density warrants awareness of neighboring high-risk IPs.

## Intelligence Narrative

IP 209.99.190.112 operates as a passive, firewalled endpoint with no exposed services. The IP's risk profile is dominated by DNSBL listings rather than active attack campaigns. While the IP itself does not exhibit malicious behavior, analysts should maintain awareness of subnet 209.99.190.0/24, which contains two IPs with significant risk scores (65 and 80). The geographic inconsistency between US geolocation and ASN registration in KN requires periodic validation. No immediate blocking is recommended; continue monitoring for changes in service exposure or threat indicator activity.

Confidence Level: Medium

Last Updated: Current Assessment

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.