209.99.190.99📋 Copy

# IP INTELLIGENCE BRIEFING: 209.99.190.99/32

Date: 2026-07-30

Classification: Moderate Risk Threat Actor / Potential Spam Source

Analyst: IPDebrief Intelligence Team

---

## EXECUTIVE SUMMARY

Target IP 209.99.190.99 presents a moderate risk profile (score: 65/100) with multiple threat indicators. The IP is geolocated to Zurich, Switzerland, but exhibits inconsistent geolocation validation. The address is listed on 3 DNSBLs and is associated with a /24 subnet showing elevated abuse density (11.1%). No active services are detected on the target IP.

---

## RISK ASSESSMENT

---

## GEOLOCATION & NETWORK ATTRIBUTES

• Country: Switzerland (CH)
• Region/City: Zurich, Zurich
• Coordinates: 47.36°N, 8.54°E
• ASN: 402253
• BGP Prefix: 209.99.184.0/21
• Service Status: Firewalled / No Services
• DNSSEC: Valid
• Geo Validation: ⚠️ Not Plausible

---

## THREAT INDICATORS

• DNSBL Listings: 3 of 8 total lists (listed)
• Known Campaigns: None identified
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Honeypot Hits: 0
• Total Incidents: 0
• Auto-Banned: No

---

## NEIGHBORHOOD ANALYSIS (209.99.190.0/24)

Abuse Density: 11.1% (Elevated)

Total Siblings: 9 IPs analyzed

Notable Neighbor Risk Scores:

• 209.99.190.200: Risk 80 (HIGH) ⚠️
• 209.99.190.113: Risk 65 (HIGH) ⚠️
• 209.99.190.126: Risk 50 (MEDIUM)
• 209.99.190.174: Risk 25 (LOW)

Risk Distribution: 1 High, 3 Medium, 5 Low risk neighbors

---

## OBSERVATION HISTORY

Seven observations recorded through July 30, 2026, showing:

• Consistent Zurich, Switzerland geolocation
• DNSSEC validation present
• DNSBL listings confirmed in recent observations
• Operator score maintained at 0.1304

---

## RELATIONSHIP GRAPH

No relationships identified (0 links to subnets, hostnames, organizations, or certificates).

---

## RECOMMENDED ACTIONS

Primary Recommendation: Increase logging verbosity and review recent activity from this IP source.

Firewall/Blocking Rules:

```bash

# iptables

iptables -A INPUT -s 209.99.190.99 -j DROP

# nftables

nft add rule inet filter input ip saddr 209.99.190.99 drop

# NGINX

deny 209.99.190.99;

# pfSense

209.99.190.99/32

# Cloudflare WAF

Block IP 209.99.190.99 — IPDebrief risk score 65

# AWS WAF

Addresses: 209.99.190.99/32

Description: IPDebrief risk 65

```

---

## INTELLEIGENCE JUDGMENT

This IP should be blocked or monitored based on:

1. Moderate risk score (65/100)

2. Multiple DNSBL listings indicating prior abuse

3. Neighbor subnet shows 11.1% abuse density with high-risk neighbors

4. Inconsistent geolocation validation

5. No legitimate service indicators

Priority: MEDIUM — Monitor for increased activity or service changes.

---

*Report generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.