91.80.131.143📋 Copy

# IP INTELLIGENCE BRIEFING: 91.80.131.143/32

## EXECUTIVE SUMMARY

IP address 91.80.131.143 is a mobile carrier endpoint from Vodafone Italia with a moderate risk score of 55/100. The IP shows no active services, no open ports, and limited network reputation. Historical data indicates threat indicators have been observed. Recommended action is monitoring and selective blocking depending on organizational policy.

---

## OWNERSHIP & INFRASTRUCTURE

The IP belongs to Vodafone Italia's mobile network infrastructure. No dedicated hosting or CDN infrastructure detected. The subnet 91.80.131.143/24 shows zero abuse density with no neighboring IPs flagged for abuse.

---

## THREAT INTELLIGENCE

The IP shows 3 DNSBL listings across 8 total lists. Control plane analysis indicates minimal operator score (0.1304) with stable routing (no route changes in 30 days).

---

## NETWORK BEHAVIOR

• Services: No open ports detected; network shows as "Firewalled / No Services"
• DNS: No PTR hostnames, no forward resolution
• Email: No SPF/DMARC records configured
• TLS: No certificates detected
• Mobile Carrier: Vodafone Italia (MCC: 222, MNC: 10)

The endpoint appears to be a legitimate mobile device without exposed services. No HTTP banner, server fingerprint, or email reputation data available.

---

## OBSERVATION HISTORY

15 total observations recorded. Recent activity (2026-07-29) confirms:

• Ownership: Vodafone Italy (consistent)
• ASN: AS30722 (consistent)
• Geo: Italy (consistent across multiple sources)
• Threat signals detected in reputation feeds

The IP has no persistent malicious designation but shows elevated risk due to DNSBL listings and historical threat indicators.

---

## RELATIONSHIPS

• Network: VODAFONE-IT-21 (91.80.128.0/17)
• Subnet: 91.80.131.143/24 (no abuse siblings detected)
• No: Hostname, certificate, or organizational links beyond network infrastructure

---

## RECOMMENDED ACTIONS

Primary Recommendation: Increase logging verbosity and review recent activity from this IP (High Severity due to elevated risk score).

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 91.80.131.143 -j DROP

# nftables

nft add rule inet filter input ip saddr 91.80.131.143 drop

# nginx

deny 91.80.131.143;

# pfSense

91.80.131.143/32

# Cloudflare WAF

ip.src eq 91.80.131.143 → BLOCK

# AWS WAF

Addresses: ["91.80.131.143/32"]

```

---

## SOC ANALYST NOTES

1. Block or Monitor Decision: Given the moderate risk score (55) and mobile carrier origin, consider blocking only if the organization receives traffic from unexpected geographic regions or during unusual hours.

2. False Positive Risk: Legitimate mobile traffic may appear from this IP range. Verify against organizational baseline before implementing permanent blocking.

3. Monitoring Priority: Track for any changes in traffic patterns, geolocation shifts, or new threat indicators.

4. Subnet Context: No abuse activity detected in the /24 subnet. This IP appears isolated from broader subnet-level threats.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.