209.99.190.115📋 Copy

# IP Intelligence Briefing: 209.99.190.115/32

Classification: Moderate Risk Residential Endpoint

Report Date: 2026-07-30

Intel Level: Standard

Assigned Risk Score: 40/100

---

## Executive Summary

IP address 209.99.190.115 is identified as a residential endpoint within the SKN Subnet & Telecom Ltd network (ASN 402253). The IP presents moderate risk (score 40) with evidence of DNS blacklist presence and recent port scanning activity. While not classified as a known attacker or spam source, the IP should be monitored for sustained malicious behavior and considered for blocking in security contexts.

---

## Network Ownership & Geography

*Note: Historical observations indicate geolocation inconsistencies with Saint Kitts and Nevis references in some probes, suggesting potential routing anomalies or spoofed origin data.*

---

## Threat Assessment

Current Risk Profile:

• Risk Score: 40 (Moderate)
• DNSBL Listed: 2 of 8 lists
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Active Campaigns: None identified

Observed Services:

• SSH (OpenSSH 8.4p1 Debian-5+deb11u6)
• Multiple port scans detected during recent observation window (2026-07-30)

---

## Neighborhood Analysis

The /24 subnet (209.99.190.0/24) exhibits moderate abuse density (0.111) with 9 neighboring IPs analyzed:

*Subject IP (209.99.190.115) shows risk score 40, positioning it in the medium-risk tier alongside several neighbors.*

---

## Historical Observations

Twelve signals observed through 2026-07-30. Key observations include:

• SSH service detection with OpenSSH 8.4p1 Debian variant
• Multiple port scanning events
• Consistent residential network classification
• No persistent malicious behavior detected over observation period

---

## Related Entities

• Network: SSTL-49 (same /21 block)
• Correlated IPs: None beyond network relationships

---

## Recommended Actions

Immediate Mitigation:

```bash

# iptables

iptables -A INPUT -s 209.99.190.115 -j DROP

# nftables

nft add rule inet filter input ip saddr 209.99.190.115 drop

# Cloudflare WAF

"ip.src eq 209.99.190.115" → BLOCK

# AWS WAF

Addresses: ["209.99.190.115/32"]

```

Recommended Policy: Block or rate-limit traffic from this IP given DNSBL presence and moderate risk score. Monitor for correlation with known malicious infrastructure.

---

## Intelligence Notes

This IP represents a residential endpoint with moderate risk characteristics. While not actively malicious per current indicators, the DNSBL presence and neighborhood risk profile suggest caution. SOC analysts should correlate with other signals before definitive blocking decisions. The subnet contains multiple higher-risk neighbors (209.99.190.200, 209.99.190.99, 209.99.190.113) warranting broader subnet-level review.

---

Generated by IPDebrief Intelligence Platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.