76.91.244.156📋 Copy

# IP Intelligence Briefing: 76.91.244.156

## Executive Summary

IP 76.91.244.156 is a Spectrum (Comcast) residential IP address located in Los Angeles, California with a moderate risk score of 50. The address is currently firewalled with no active services, but appears in two DNS blacklist entries with high severity ratings.

## Current Risk Profile

• Risk Score: 50 (Moderate)
• Location: United States, California, Los Angeles
• ISP/Provider: Spectrum Communications (spectrum.com)
• Network Classification: Residential/Firewalled endpoint
• DNS: syn-076-091-244-156.res.spectrum.com (PTR hostname confirmed)
• Open Ports: None detected
• DNSBL Status: Listed on 2 of 8 DNSBL feeds (high severity)

## Control Plane Analysis

• Origin ASN: 20001 (Level 3 Communications)
• BGP Prefix: 76.90.0.0/15
• Route Stability: Unstable (0 route changes in 30 days, isRouteStable: false)
• RPKI: Validation status not determined
• GeoConsensus: Confirmed across multiple sources

## Temporal Observation History

Total of 11 signal observations recorded. Recent activity (2026-07-30) shows:

• Geographic signals from Los Angeles, California (confidence: 70%)
• Operator score: 0.1304 (Minimal operator risk)
• DNSBL listings with 2 high-severity entries among 8 total
• Multiple geo-verification signals with confidence scores ranging 35-85%

## Relationship Analysis

DNS association links only to hostname: syn-076-091-244-156.res.spectrum.com. No organizational, certificate, or subnet relationships identified beyond the Spectrum residential domain.

## Neighborhood Assessment

Subnet 76.91.244.0/24 analysis:

• Active Neighbors: 0
• Abuse Density: 0%
• Risk Distribution: No high/medium/low risk neighbors detected
• Inherited Risk: None

## Threat Indicators

• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Campaign Correlation: No known campaigns matched
• Cert Matches: 0
• Banner Matches: 0

## Recommended Actions

1. Monitor: Given moderate risk score and DNSBL presence, monitor for outbound connections from this IP

2. Allow List: If this is legitimate residential traffic from a known user, consider allowing with logging

3. Block Criteria: If this IP was observed initiating connections to internal assets, add to watchlist due to DNSBL presence

4. Context: Verify if this IP matches any known user/device in your network inventory before blocking

## Intelligence Note

This IP represents a residential endpoint with no active services. The DNSBL listings suggest prior abuse history. The moderate risk score combined with zero active services and no neighbors indicates this may be a dormant or previously compromised residential address. SOC analysts should evaluate based on connection context rather than IP reputation alone.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.