90.173.78.90📋 Copy

# IP INTELLIGENCE BRIEFING

## Target: 90.173.78.90/32

Classification: HIGH RISK

Date: Current

---

## EXECUTIVE SUMMARY

IP 90.173.78.90 is classified as High Risk with a risk score of 80/100. The address is a mobile carrier IP assigned to Orange Espagne SA, with evidence of malicious activity including DNSBL listings on 6 of 8 security blacklists. Despite the legitimate mobile carrier infrastructure classification, the IP exhibits threat indicators requiring defensive monitoring.

---

## NETWORK IDENTIFICATION

• ASN: 12479 (Orange Espagne SA)
• Organization: Angel Luis Gonzalez
• RIR: RIPE
• BGP Prefix: 90.173.78.0/24
• Mobile Carrier: Orange Espagne SA (MCC: 214, MNC: 03)
• Technology: LTE/5G
• Geolocation: Madrid, Spain (40.46°N, -3.75°W)
• Reverse DNS: 90.pool90-173-78.static.orange.es

---

## THREAT INDICATORS

• Risk Score: 80/100
• Abuse Confidence: High
• DNSBL Listed: 6 of 8 security lists
• Known Campaigns: None identified
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 6

Control Plane Assessment:

• Route Stability: Unstable (isRouteStable: false)
• Operator Score: 0.1304 (Minimal)
• DNSSEC: Valid
• RPKI State: Not applicable

---

## NETWORK ROLE CLASSIFICATION

• Primary Classification: Mobile Carrier
• Infrastructure Type: Mobile Carrier
• Connection Type: Mobile (LTE/5G)
• Services: Firewalled / No Services Detected
• Cloud/CDN/Proxy: No
• Hosting/VPN: No

---

## OBSERVATION HISTORY (17 Signals)

Recent threat activity timeline:

• 2026-06-24: Geolocation signal confirmed (Spain/Madrid)
• 2026-06-16: CRITICAL - Blacklist activity detected across 8 lists (6 active listings), maximum severity: HIGH
• 2026-06-04: Control plane signal with minimal operator risk (0.1304)
• 2026-06-02: Initial geolocation signal (Madrid, Spain)

Temporal Analysis:

• Threat Observation Count: 1
• Threat Persistence Days: 0
• Ownership Changes: 0
• Is Persistently Malicious: No

---

## NEIGHBORHOOD ANALYSIS

• Subnet: 90.173.78.90/24
• Abuse Density: 1 (1 threat sibling identified)
• Classification: Mostly Clean
• Inherited Risk: 2
• Total Siblings: 1
• Active Siblings: 0

Network Relationships: 37 relationships identified, primarily associated with OrangeFTTH network infrastructure.

---

## EMAIL REPUTATION

• SPF Record: Present
• DMARC Record: Present
• Sender Score: Not applicable (mobile carrier IP)

---

## RECOMMENDED SECURITY ACTIONS

Firewall Rules (iptables/nftables)

```bash

# Block outbound connections from this IP (if inbound)

iptables -A INPUT -s 90.173.78.90 -j DROP

nft add rule inet filter input ip saddr 90.173.78.90 drop

```

Cloudflare WAF Rules

```yaml

# Block this IP at edge level

rules:

- action: block

ip: 90.173.78.90

```

AWS WAF Rules

```yaml

# Create IP set and block rule

IPSet: 90.173.78.90

Rule: Block requests from IPSet

```

Monitoring Recommendations

1. Monitor for C2 Activity: Despite mobile carrier classification, the high-risk score and blacklist presence warrant active monitoring for command-and-control communications.

2. Watch Neighbor Subnet: The 90.173.78.0/24 subnet contains 1 threat sibling; monitor for lateral activity patterns.

3. DNSBL Monitoring: The IP is listed on 6 of 8 major blacklist providers; track for changes in listing status.

4. Route Stability: BGP prefix shows instability; monitor for routing anomalies that could indicate infrastructure manipulation.

---

## ANALYST NOTES

This IP address presents a moderate-to-high risk scenario. While classified as a legitimate mobile carrier (Orange Espagne SA), the high risk score (80), active blacklist presence (6 of 8 lists), and unstable routing characteristics suggest potential abuse of mobile carrier infrastructure for malicious purposes. The absence of open ports and services reduces the likelihood of direct exploitation but does not eliminate threat potential. SOC teams should implement blocking rules while monitoring for associated activity from neighboring subnet IPs.

Priority: MEDIUM-HIGH

Action: Block at perimeter, monitor for evasion techniques

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.