89.186.9.87📋 Copy

# IP INTELLIGENCE BRIEFING: 89.186.9.87/32

## EXECUTIVE SUMMARY

IP address 89.186.9.87 has been assessed as High Risk (score: 70/100). The address is associated with Polish infrastructure and exhibits historical threat signals despite currently showing no open services.

---

## RISK ASSESSMENT

---

## GEOGRAPHIC & OWNERSHIP DATA

Location:

• Country: Poland (PL)
• Region: Lublin
• Coordinates: 51.92°N, 19.15°E
• Timezone: Europe/Warsaw
• Accuracy Radius: 400km

Network Infrastructure:

• ASN: AS39716 (ITCARE-MNT)
• Org: VIP-NET9
• CIDR Block: 89.186.9.0/24
• RIR: RIPE
• Registration Date: Not available

---

## NETWORK BEHAVIOR & SERVICES

Service Status: Firewalled / No Services

• Open Ports: None detected
• TLS Certificate: None
• HTTP Banner: None detected
• Connection Type: N/A

DNS Resolution:

• PTR Hostname: sta9.087.vip-net.pl
• Forward Confirmed: Yes
• Hosted Domain: vip-net.pl
• Forward Resolution Count: 1

---

## THREAT INDICATORS

DNSBL Presence: Listed on 4 of 8 monitored DNS blacklists

---

## OBSERVATION HISTORY

Total Observations: 16 signals recorded

Recent Signals Include:

• 2026-07-24 02:20:13 - Threat indicator detected (AS39716, Lublin, PL) - Confidence: 75%
• 2026-07-24 02:19:55 - ISP identified as VIP AGENCJA REKLAMY sp. z o.o, Warsaw - Confidence: 60%
• 2026-07-24 02:19:45 - Operator score: 0.2609 (Basic) - Confidence: 60%
• 2026-07-24 02:19:45 - Multi-dimensional profile with 66.67% data sufficiency - Confidence: 17%

Temporal Analysis:

• Threat Persistence Days: 0
• Ownership Changes: 0
• Persistently Malicious: No

---

## NETWORK RELATIONSHIPS

DNS Associations:

• sta9.087.vip-net.pl (hostname)

Network Associations:

• VIP-NET9 (network block)

---

## SUBNET ANALYSIS

Subnet: 89.186.9.0/24

• Total Siblings: 0
• Active Siblings: 0
• Threat Siblings: 0
• Abuse Density: 0
• Classification: Not classified

---

## TRACERoute & NETWORK PATH

• Hop Count: 18
• Transit Networks: Comcast, Cogent
• First Hop RTT: 0.2ms
• Last Hop RTT: 157.1ms
• Timed Out Hops: 3

---

## RECOMMENDED ACTIONS

Immediate Actions Required

1. Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 89.186.9.87 -j DROP

# nftables

nft add rule inet filter input ip saddr 89.186.9.87 drop

# nginx

deny 89.186.9.87;

```

2. Cloud Platform Recommendations:

• Cloudflare WAF: Block with expression `ip.src eq 89.186.9.87`
• AWS WAF: Block address 89.186.9.87/32

3. Monitoring:

• Increase logging verbosity for this IP
• Review recent activity logs
• Monitor for new service openings

---

## ANALYST NOTES

The IP address presents a moderate threat profile with:

• Historical threat indicators despite current dormancy
• Multiple DNSBL listings suggesting prior malicious use
• Polish infrastructure with association to advertising agency (VIP AGENCJA REKLAMY)
• No current active services detected (potentially compromised or abandoned)

Recommendation: Block at perimeter with enhanced logging for correlation analysis. Monitor for any service reactivation or neighbor activity in the /24 subnet.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.