88.20.35.254📋 Copy

## IP Intelligence Briefing: 88.20.35.254/32

Classification: Moderate Risk | Risk Score: 50

Executive Summary

IP 88.20.35.254 is a residential static IP assigned to Telefonica de Espana (ASN 3352) RIMA network infrastructure. The IP shows moderate risk (50) primarily due to DNSBL listings (2 of 8 lists) and geolocation inconsistencies. While the subnet neighborhood remains clean (0 abuse density), the IP warrants monitoring due to certificate misalignment and routing anomalies.

Technical Profile

• Network: 88.20.35.254/24, RIMA (Telefonica de Espana)
• Geolocation: Spain (ES), Argujillo region; RIR: Ripe
• Infrastructure Type: Mobile Carrier (Movistar/LTE-5G) repurposed as web server
• DNS: 254.red-88-20-35.staticip.rima-tde.net (static residential IP)
• Services: HTTP/HTTPS on ports 80/443, Apache/2.4.18 (Ubuntu)
• TLS Certificate: Let's Encrypt issued to traumapp.ddns.net (certificate subject mismatch with host)

Threat Indicators

• DNSBL Listings: 2 of 8 blacklists (dnsblListedCount)
• GeoValidation: 5 probes, avg RTT 130.6ms; distance 1716.4km from probe location
• Control Plane: BGP prefix 88.20.0.0/16, isRouteStable: false
• Campaign Correlation: 0 correlated IPs, 0 CERT matches

Historical Observations

24 total observations recorded. Recent activity includes:

• Geolocation inconsistencies (Spain primary, US New York observed in one trace)
• HTTP 302 redirects with Apache server fingerprint
• No persistent threat indicators (threatPersistenceDays: 0)

Neighborhood Context

Subnet 88.20.35.254/24 classification: clean

• Total siblings: 5, Active: 4
• Abuse density: 0
• Sibling risk scores: 0, 15, 25, 25 (all low-medium)
• No high-risk neighbors detected

Recommended Actions

Firewall/Blocking Recommendations:

• `iptables -A INPUT -s 88.20.35.254 -j DROP`
• `nft add rule inet filter input ip saddr 88.20.35.254 drop`
• Cloudflare WAF: Block with expression `ip.src eq 88.20.35.254`
• AWS WAF: Add address `88.20.35.254/32`

SOC Analyst Guidance:

1. Monitor TLS Certificate Mismatch: Certificate issued to traumapp.ddns.net does not align with expected host. Verify if this is intentional or indicates compromised infrastructure.

2. Track Geo Inconsistencies: One observation traced to US New York despite Spain registration. Investigate routing anomalies or spoofing attempts.

3. DNSBL Monitoring: IP listed on 2 of 8 DNSBLs. Confirm which lists and assess impact on reputation.

4. Residential IP Risk: Mobile carrier static IPs are commonly abused for spam/malware. Consider broader subnet monitoring.

5. Risk Score Context: Provider and authority scores are 0, indicating this is not a known malicious infrastructure but rather a misconfigured or compromised residential endpoint.

Conclusion

IP 88.20.35.254 represents a moderate-risk residential endpoint with DNSBL listings and certificate/host misalignment. The subnet environment is clean, suggesting isolated rather than coordinated activity. Recommended for monitoring and blocking if traffic patterns indicate abuse. No immediate evidence of active campaign participation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.