89.106.137.149📋 Copy

## INTELLIGENCE BRIEFING: 89.106.137.149/32

Classification: HIGH RISK

Date: Current

Reporting Platform: IPDebrief

---

EXECUTIVE SUMMARY

IP 89.106.137.149 presents an elevated threat posture with a risk score of 80/100. While no active threat indicators are currently present, the IP is associated with Ireland-based residential broadband infrastructure and exhibits control plane anomalies including DNSBL listings. Immediate monitoring and blocking recommendations are advised.

---

OWNERSHIP & GEOLOCATION

• ASN: 51173
• Organization: IE-PBB-PREMIER-BROADBAND
• CIDR Block: 89.106.137.0/24
• RIR: Ripe
• Geolocation: Clonmel, Munster, Ireland (53.14°N, 7.69°W)
• Timezone: Europe/Dublin
• Registration: Ripe registry

---

RISK PROFILE

• Risk Score: 80/100 (HIGH)
• Classification: High Risk
• Stability: Not persistently malicious
• DNSBL Status: Listed on 4 of 8 total DNSBL feeds
• Control Plane: Route stability flags present; RPKI state not validated

---

THREAT INDICATORS

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0 (direct blacklist count, though DNSBL present)
• Campaign Affiliation: No known campaigns matched
• Active Threats: None currently observed

---

NETWORK INFRASTRUCTURE

• Services: Firewalled / No Services
• Open Ports: None detected
• DNS: No PTR hostnames; no forward resolution
• Mobile Carrier: No
• Hosting/Proxy: No

---

NEIGHBORHOOD ANALYSIS

Subnet: 89.106.137.0/24

• Abuse Density: 0%
• Total Siblings: 4
• Active Siblings: 3
• Threat Siblings: 0
• Neighbor Risk Distribution: 2 Medium Risk (55/100), 1 Low Risk (40/100)

Sibling IPs:

---

OBSERVATION HISTORY

• Total Observations: 11 signals
• Most Recent: 2026-07-30T10:53:09Z
• Ownership Changes: 0
• Threat Persistence Days: 0
• Signal Types: Ownership, ASN, Geolocation, Network Classification, Subnet Abuse

---

RECOMMENDED SECURITY ACTIONS

IMMEDIATE ACTIONS:

1. Increase logging verbosity for traffic from this IP

2. Block at perimeter firewall per risk score 80/100

FIREWALL RULES:

```bash

# iptables

iptables -A INPUT -s 89.106.137.149 -j DROP

# nftables

nft add rule inet filter input ip saddr 89.106.137.149 drop

# nginx

deny 89.106.137.149;

# pfSense

89.106.137.149/32

# Cloudflare WAF

Block IP 89.106.137.149

# AWS WAF

Block 89.106.137.149/32

```

---

INTELLIGENCE CONTEXT

The elevated risk score (80/100) contrasts with the lack of active threat indicators, suggesting historical reputation issues rather than current malicious activity. The IP is part of a residential broadband network with moderate risk neighbors. The absence of open services indicates this IP may be used for outbound traffic or has been configured to limit exposure.

MONITORING RECOMMENDATION: Continue surveillance of this IP and its /24 subnet, particularly given the 4 DNSBL listings and route stability anomalies.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.