87.79.133.97📋 Copy

# IP Intelligence Briefing: 87.79.133.97

## Executive Summary

IP 87.79.133.97 is a low-risk residential dial-up address assigned to NetCologne (AS8422) in Cologne, Germany. The IP shows no malicious activity indicators and is classified as a basic residential endpoint with no open services or threat associations.

---

## Technical Profile

Network Classification:

• ASN: 8422 (Administrator Contact NetCologne)
• CIDR: 87.79.128.0/18 (NC-DIAL-IN-POOL)
• Country/Region: Germany, North Rhine-Westphalia, Cologne
• RIR: RIPE
• Network Type: Residential Dial-Up (XDSL)

Risk Assessment:

• Overall Risk Score: 0/10
• Provider Score: 0/10
• Authority Score: 0/10
• Reputation: Low Risk
• Blacklist Status: Not listed (0 DNSBL entries)

---

## Network Behavior Analysis

Services:

• No open ports detected
• No TLS certificates or HTTP banners
• No active services running

DNS Resolution:

• PTR Record: xdsl-87-79-133-97.nc.de
• Forward resolution confirmed
• Hosted by NetCologne infrastructure
• No email authentication (SPF/DMARC) configured

Control Plane:

• Operator Score: 0.2609 (Basic classification)
• BGP Prefix: 87.78.0.0/15
• Route stability: False (minor BGP changes observed)
• DNSSEC: Valid

---

## Threat Indicators

Active Threat Signals: None

• No known attacker reputation
• No Tor exit node activity
• No spam source designation
• No malicious campaign associations
• Zero blacklist entries across all feeds

Historical Activity:

• 19 observations recorded (most recent: 2026-07-27)
• Single threat observation event detected
• Not classified as persistently malicious
• Recent signals include port scanning reconnaissance (low confidence)

---

## Neighborhood Analysis

Subnet Context (87.79.133.0/24):

• Total sibling IPs: 0
• Abuse density: 0%
• High-risk neighbors: 0
• Medium-risk neighbors: 0
• Low-risk neighbors: 0

The IP operates in isolation with no adjacent malicious activity in its immediate subnet.

---

## Relationships Graph

Identified Associations:

• DNS hostname: xdsl-87-79-133-97.nc.de (duplicate entry in relationship database)
• Network: NC-DIAL-IN-POOL (same network block)
• No external entity links detected (no certificates, no related organizations)

---

## Recommended Actions

Firewall/Blocking:

• No blocking recommended — IP is low-risk residential endpoint
• Allow inbound/outbound traffic consistent with residential user behavior

Monitoring:

• Monitor for service changes (port opening)
• Track DNS resolution patterns
• No immediate threat mitigation required

Alerting:

• No alerting thresholds triggered
• Risk score remains at baseline (0)

---

## Intelligence Conclusion

IP 87.79.133.97 represents a legitimate residential dial-up connection in Germany with no observable malicious activity. The IP belongs to NetCologne's dial-in pool infrastructure and shows typical residential endpoint characteristics with no open services or threat indicators. SOC analysts should treat this as benign traffic unless behavioral anomalies emerge in future observations.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.