79.116.38.6📋 Copy

IP INTELLIGENCE BRIEFING

Target: 79.116.38.6/32

Date: 2026-07-22

Classification: Moderate Risk (Score: 50/100)

---

EXECUTIVE SUMMARY

IP 79.116.38.6 is a firewalled infrastructure endpoint owned by DIGIMOBIL Spain (AS57269). The IP resides in the 79.116.38.0/24 CIDR block with no open services detected. Despite a moderate risk score of 50, the subnet shows zero abuse density and no active threat indicators. The IP is primarily identified through DNS PTR records and is associated with digimobil.es infrastructure.

OWNERSHIP & REGISTRATION

GEOLOCATION

THREAT INDICATORS

• Blacklist Count: 0
• Abuse Confidence Score: None
• Known Campaigns: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• DNSBL Listed: 2/8 total lists
• Operator Score: 0.1304 (Minimal)

NETWORK ROLE & SERVICES

• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• TLS Certificate: None
• HTTP Banner: None
• Cloud/CDN/VPN/Proxy/Hosting: No
• Mobile Carrier: No

DNS ANALYSIS

SUBNET INTELLIGENCE (79.116.38.0/24)

• Abuse Density: 0% (Clean)
• Classification: Clean
• Threat Siblings: 0
• Active Siblings: 0
• Total Siblings: 1
• Risk Distribution: High: 0, Medium: 0, Low: 0

OBSERVATION HISTORY (19 Signals)

• Most Recent Signal: 2026-07-22T17:22:28Z
• Threat Persistence Days: 0
• Persistent Malicious: False
• Geo Signals: Consistent Madrid, Spain (40.412, -3.6871)
• RTT Range: 125-130ms
• Geo Plausibility: Validated

CONTROL PLANE

• BGP Prefix: 79.116.0.0/16
• Origin ASN: 57269
• Route Stable: False
• DNSSEC Valid: True
• IRR Consistency: N/A

RELATIONSHIP GRAPH

• Same Network: ES-DIGI-SPAIN (3 instances)
• DNS Associations: 79-116-38-6.digimobil.es (4 instances)

---

RECOMMENDED ACTIONS

Due to moderate risk score (50), defensive blocking is recommended with caution. The following rules are provided for implementation:

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 79.116.38.6 -j DROP

# nftables

nft add rule inet filter input ip saddr 79.116.38.6 drop

# NGINX

deny 79.116.38.6;

# pfSense

79.116.38.6/32

```

WAF Rules:

```json

// Cloudflare WAF

{

"description": "Block 79.116.38.6 — IPDebrief risk score 50",

"action": "block",

"filter": { "expression": "ip.src eq 79.116.38.6" }

}

// AWS WAF

{

"Addresses": ["79.116.38.6/32"],

"Description": "IPDebrief risk 50"

}

```

---

ASSESSMENT NOTES

The IP shows a moderate risk profile primarily due to its association with the broader 79.116.0.0/16 BGP prefix, which is flagged as route-unstable. However, the specific endpoint (79.116.38.6) demonstrates clean operational characteristics: no open services, no threat indicators, and a clean subnet environment with zero abuse density. The absence of persistent malicious activity and the presence of valid SPF/DMARC records suggest legitimate infrastructure.

SOC ANALYST RECOMMENDATION: Monitor but do not block immediately. The moderate risk score may reflect BGP-level instability rather than endpoint-specific malicious activity. If traffic is observed from this IP, apply allowlisting with logging enabled for 7-14 days to assess actual behavior patterns before implementing permanent blocking measures.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.