89.181.112.232📋 Copy

# IP Intelligence Briefing: 89.181.112.232

## Executive Summary

IP address 89.181.112.232 presents moderate risk (score: 40) with classification as a firewalled endpoint showing no active services. The IP resolves to Portugal (PT) under ASN 2860 (IP-MNT) within the RIPE region. No active threat indicators or known malicious campaigns were identified.

## Technical Profile

• Risk Score: 40 (Moderate Risk)
• ASN: 2860 (IP-MNT)
• Location: Portugal (39.4°N, -8.22°W)
• Network Role: Firewalled / No Services Detected
• DNS Resolution: 89-181-112-232.net.novis.pt (novis.pt)
• PTR Record: Forward confirmed
• DNSBL Status: Listed on 2 of 8 total blacklists

## Observations & History

Analysis retrieved 23 observation records. Recent monitoring from June 2026 captured routing stability signals with operator scores between 0.26-0.39. The IP demonstrated stable ownership (0 ownership changes) and consistent network routing. No persistent malicious behavior patterns emerged across the observation window.

## Network Context

• Subnet: 89.181.112.232/24
• Abuse Density: 0 (clean)
• Threat Siblings: 0
• Total Siblings: 1 (1 active)

The /24 subnet maintains a clean classification with no inherited risk signals. The IP operates within a stable BGP prefix (89.181.0.0/16) with 11,826 days of RIR registration.

## Threat Indicators

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Correlations: 0
• Certificate Matches: 0

## Network Relationships

36 relationship records identified, primarily showing same-network associations with NOS infrastructure. No cross-network or organizational relationships detected.

## Recommended Actions

Firewall rules provided for multiple platforms based on risk profile:

• iptables: `iptables -A INPUT -s 89.181.112.232 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 89.181.112.232 drop`
• nginx: `deny 89.181.112.232;`
• pfSense: Block 89.181.112.232/32
• Cloudflare WAF: Block with expression `ip.src eq 89.181.112.232`
• AWS WAF: Block address 89.181.112.232/32

*Note: Recommendations should be combined with additional threat intelligence signals before implementation.*

## Assessment

The IP address demonstrates moderate risk characteristics primarily driven by DNSBL listings and operator scoring. The endpoint appears inactive (firewalled) with no evidence of active threat generation. Recommend monitoring for service activation or increased abuse density in the /24 subnet.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.