216.132.188.189📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 216.132.188.189/32

Classification: Moderate Risk Infrastructure

Date: Analysis based on current IPDebrief data

---

## EXECUTIVE SUMMARY

IP 216.132.188.189 presents as a firewalled infrastructure endpoint with moderate risk scoring (40/100). The address belongs to GTT-BITE-HRS-NET (ASN 19211) and shows no active threat indicators, no known malicious campaigns, and no honeypot hits. DNS records resolve to sender-QAOFOX.lumaneural.com. Geolocation data shows inconsistencies between US and Lithuania reports, requiring validation.

---

## OWNERSHIP & NETWORK ATTRIBUTES

---

## GEOLOCATION ANALYSIS

Multiple geolocation sources report conflicting data:

• Primary reports: United States (US)
• Secondary reports: Lithuania (37.751, -97.822)
• Accuracy radius: 2,500 km
• Geo consensus: True
• Validation status: GeoPlausible flagged false on some probes

Recommendation: Validate geolocation through secondary sources due to significant regional discrepancies.

---

## THREAT INTELLIGENCE

Overall Risk Score: 40/100 (Moderate)

Threat Indicators:

• Known attacker: No
• Spam source: No
• Tor exit node: No
• Blacklist count: 0
• Known campaigns: None

Control Plane Data:

• DNSBL listings: 2 out of 8 total lists
• Route stability: Unstable
• DNSSEC: Valid
• Operator score: 0.2609 (Basic)

Behavioral Analysis:

• Honeypot hits: 0
• Enumeration strikes: 0
• Threat persistence: 0 days

---

## DNS & EMAIL REPUTATION

• PTR Hostname: sender-QAOFOX.lumaneural.com
• Forward resolution: Confirmed (1 hostname)
• SPF Record: Not configured
• DMARC Record: Not configured
• Email reputation: No score available

Note: The hostname prefix "sender-" suggests potential email infrastructure, though no active email services detected.

---

## NEIGHBORHOOD ANALYSIS (216.132.188.0/24)

Subnet Risk Profile:

• Total siblings: 15
• Active siblings: 6
• Threat siblings: 1
• Abuse density: 0.0667
• Classification: Mostly clean

High-Risk Neighbors: None identified

Medium-Risk Neighbors: 9 (scores 40-55)

Low-Risk Neighbors: 5 (scores 15)

Notable neighbors requiring attention:

• 216.132.188.31, .72, .83, .87, .105, .170, .197, .230 (risk score: 55)
• 216.132.188.27, .36, .83, .87, .105, .170, .188, .196, .197 (risk score: 40)
• 216.132.188.7, .97, .188, .196, .230 (risk score: 15)

---

## SERVICE & NETWORK STATE

• Open ports: None detected
• Service purpose: Firewalled / No Services
• Cloud/CDN/VPN/Proxy: Not detected
• Mobile carrier: None
• Anycast: No

---

## OBSERVATION HISTORY

Total Observations: 19

Recent Signal Types:

1. Network latency: 138.4ms avg RTT, 7,625km distance (US coordinates)

2. Subnet classification: Mostly clean (abuse density 0.0667)

3. Network role: Not cloud, CDN, Tor, VPN, proxy, or hosting

4. Ownership stability: 0 ownership changes

5. Geolocation probe: US coordinates (39.83, -98.58) with 35% confidence

---

## RELATIONSHIP GRAPH

Identified Associations (6 total):

• DNS Associations: sender-QAOFOX.lumaneural.com (3 entries)
• Network Associations: GTT-BITE-HRS-NET (3 entries)

---

## SOC ACTIONS & RECOMMENDATIONS

Immediate Actions

1. Monitor DNS activity for sender-QAOFOX.lumaneural.com for suspicious patterns

2. Validate geolocation through independent sources due to US/Lithuania discrepancy

3. Track subnet activity — monitor other 14 sibling IPs for threat indicators

Firewall/Blocking Considerations

• No immediate block recommendation — no active threat indicators
• Monitor for changes in service state or DNS activity
• Consider blocking if sender-QAOFOX.lumaneural.com domain shows malicious activity

Long-term Intelligence

• Track ownership changes (currently stable with 0 changes)
• Monitor DNSBL listing status (currently 2/8 lists)
• Watch for emergence of high-risk siblings in the /24 subnet

---

Status: Monitor | Threat Level: Moderate | Confidence: High

*Report generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.