72.27.198.117📋 Copy

# IP Intelligence Briefing: 72.27.198.117/32

Classification: Moderate Risk (Score: 40)

Date: Current analysis

Scope: Single IP, subnet, historical signals, and relationship graph

---

## Ownership and Network Identity

The IP address belongs to Cable and Wireless Jamaica (ASN 30689), registered under netname CWJ-16BLK within the ARIN RIR. The broader CIDR block is 72.27.0.0/17. Network classification identifies this as a Mobile Carrier infrastructure with DSL connection type, flagged as mobile-capable but not residential. DNS resolution yields `117-198-27-72-br1-DYNAMIC-dsl.cwjamaica.com`, confirming dynamic assignment from the carrier's infrastructure.

## Geographic and Control Plane Analysis

Geolocation places the IP in Falmouth, Jamaica (Region 07). However, geolocation validation flags an inconsistency: one signal observation recorded the country as Colombia, while RTT measurements indicate 8,060.8 km distance with 73ms RTT—below the theoretical minimum of 161.2ms for that distance, suggesting either routing anomalies or geolocation data integrity issues.

Control plane analysis shows the IP originates from BGP prefix 72.27.198.0/23. The route is not stable with zero route changes observed in the past 30 days. The IP is listed on 2 of 8 DNS blacklists, indicating prior abuse associations.

## Threat Posture

Current threat indicators show no active malicious activity:

• No known attacker signatures
• No spam source designation
• Not a Tor exit node
• No proxy or VPN classification
• No open ports detected
• No TLS certificates or HTTP services running

Abuse confidence score is null, and blacklist count is zero despite the DNSBL presence. No known campaigns correlate with this IP.

## Neighborhood and Related Entities

The /24 subnet (72.27.198.0/24) exhibits zero abuse density and is classified as clean. The neighborhood contains only one sibling IP with no active siblings or threat siblings observed. No high-risk neighbors detected in the immediate vicinity.

Relationship graph shows associations limited to:

• Same network (CWJ-16BLK)
• DNS hostname associations to the carrier's dynamic DSL address

## Historical Observation Trend

Analysis of 18 historical observations (most recent: 2026-07-23) reveals consistent classification patterns. Signals have remained stable with no persistent malicious activity detected. Ownership changes are zero, and threat persistence days are null. Geolocation signals show occasional inconsistencies, particularly country reporting discrepancies.

## Risk Assessment and Recommendations

The IP presents a moderate risk primarily due to DNSBL listings and geolocation inconsistencies, but lacks active threat indicators. As a mobile carrier DSL assignment, this IP may serve legitimate consumer or business use. The zero open ports and no service banners suggest the host is firewalled or minimally exposed.

Recommended Actions:

1. Monitor DNSBL status – Investigate the two blacklist listings to determine if they are false positives or indicate prior abuse

2. Verify geolocation accuracy – Cross-reference with independent sources given the Colombia/Jamaica discrepancy

3. Allow with logging – No immediate blocking recommended; maintain logging for behavioral analysis

4. No firewall rules required – No specific iptables/nftables rules generated due to low active threat profile

Threat Level: LOW to MODERATE – Infrastructure-level IP with historical blacklist associations but no current active malicious signals.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.