37.238.45.202
IP Intelligence Briefing: 37.238.45.202
*Generated via IPDebrief tools: Profile, History, Relationships, Neighbors*
---
**Core Profile**
- Risk Score: 80 (High Risk)
- Ownership: Registered to ae-earthlink-dmcc-1-mnt (ASN 199739) under RIPE.
- Geolocation:
- Confirmed as New York, NY, US (latitude/longitude unspecified).
- Inconsistent historical observations:
- Traceroute via Comcast (US).
- Conflicting geolocation data:
- Istanbul, Turkey (confidence 0.7, June 8).
- Baghdad, Iraq (confidence 0.7, June 4).
- Geolocation plausibility: False (discrepancies suggest spoofing or misattribution).
---
**Threat Indicators**
- No direct threat indicators: No malware, phishing, or spam associations.
- DNS & Services:
- No open ports, TLS certs, or HTTP services detected.
- No DNSSEC validation issues.
- Network Role:
- Classified as Firewalled / No Services.
- No CDN, cloud, or residential infrastructure flags.
---
**Observation History**
- Recent Activity (June 8, 2026):
- Traceroute reached target via Comcast (17 hops, 2059ms RTT).
- Geolocation anomalies:
- Istanbul, Turkey (iata code IST).
- Baghdad, Iraq (latitude 33.3364, longitude 44.4004).
- Minimal signal confidence (0.14–0.30), suggesting low certainty in observations.
---
**Relationships**
- Network Links:
- Linked to BROADBAND-SUBSCRIBERS-POOL (repeated 9 times).
- No external relationships: No hostnames, organizations, or certificates tied to this IP.
---
**Neighborhood Analysis**
- Subnet: 37.238.45.202/24.
- Neighbor Data:
- 0 abusive IPs in subnet.
- No active siblings or threat siblings reported.
---
**Actionable Insights**
1. Monitor Geolocation Anomalies: The IP’s inconsistent location data (US vs. Turkey/Iraq) may indicate spoofing, misconfigured routing, or a malicious actor using proxy networks.
2. Investigate Traceroute Path: The 17-hop path via Comcast raises questions about network resilience or potential egress points for malicious traffic.
3. Watch for Emerging Threats: Despite no current indicators, the high risk score and historical inconsistencies warrant continuous monitoring for unexpected behavior.
---
Recommendation: Block or restrict this IP in firewall rules until geolocation discrepancies are resolved and threat indicators are confirmed. Use IPDebrief’s action tool to generate specific rules if needed.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | ae-earthlink-dmcc-1-mnt |
| ASN | AS199739 |
| Network Name | — |
| CIDR Block | — |
| RIR | RIPE |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 13% | 1 | 1 |
| routing | 13% | 1 | 1 |
| services | 13% | 1 | 1 |
| ownership | 27% | 2 | 3 |
| reputation | 0% | 0 | 0 |
| geolocation | 17% | 1 | 1 |
| Overall | 14% | 6 | 7 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Fresh
| First Seen | 2026-05-19 21:40:12 UTC |
| Last Seen | 2026-06-26 18:11:16 UTC |
| Profile Built | 2026-06-09 06:30:53 UTC |
| Data Freshness | Fresh |
| Signal Types | 16 |
| Total Observations | 17 |
Full dossier details are available via our API.