102.212.183.94📋 Copy

INTELLIGENCE BRIEFING: IP Address 102.212.183.94/32

EXECUTIVE SUMMARY

The IP address 102.212.183.94 presents a low-risk profile with a risk score of 25. The address exhibits minimal threat indicators and no active malicious campaigns. However, the IP shows inconsistent geolocation data and one DNSBL listing that warrants monitoring.

OWNERSHIP AND INFRASTRUCTURE

The IP address operates under ASN 36962 with BGP prefix 102.212.180.0/22. Ownership information, organization details, and netname registration data were not available. The control plane indicates the route is not stable and the IP is not classified as MOAS (Multiple Origin Autonomous System). The operator score of 0.1304 is classified as "Minimal." The address shows no evidence of being a VPN, proxy, Tor exit node, CDN, cloud service, or hosting provider.

GEOLOCATION ANALYSIS

Geolocation data presents inconsistencies. The primary profile indicates London, GB (Great Britain), with region listed as "Lusaka Province." Historical observations recorded Lusaka, Zambia (ZM) with 0.70 confidence on 2026-07-19. Traceroute analysis showed 30 hops with 16 timed-out hops, with Comcast identified as a transit network. The first hop response time was 0.4ms and the last hop was 290.4ms. DNSSEC validation is confirmed as valid.

THREAT INDICATORS

Threat assessment shows no active malicious activity:

• Not classified as a known attacker or spam source
• No Tor exit node activity detected
• No blacklist count reported in the primary profile
• One DNSBL listing observed (1 of 8 total lists) with maximum severity "high"
• No threat campaigns correlated
• No honeypot hits recorded (0)
• No enumeration strikes detected (0)
• No WAF violations observed (0)
• Total incidents: 0

The IP is not persistently malicious and shows zero threat persistence days.

NETWORK SERVICES AND DNS

The address shows no open ports and is classified as "Firewalled / No Services." No TLS certificates, HTTP titles, or server banners were observed. DNS analysis shows no PTR hostnames, no forward resolution, and zero hosted domains. Email authentication is not configured (no SPF or DMARC records).

NEIGHBORHOOD ANALYSIS

The /24 subnet (102.212.183.94/24) contains 2 neighbor IPs with an abuse density of 0. Risk distribution shows 0 high-risk, 0 medium-risk, and 1 low-risk neighbor. No threat siblings were identified within the subnet.

RELATED ENTITIES

No relationships were discovered linking this IP to other entities, subnets, hostnames, organizations, or certificates.

OBSERVATION HISTORY

Nine observations were recorded, with the most recent activity on 2026-07-19. Observations included geolocation changes, operator score measurements, DNSBL listings, and DNSSEC validation. The IP shows no persistent threat activity.

RECOMMENDED ACTIONS

No specific firewall rules or security recommendations were generated. The low risk score (25) and minimal threat indicators suggest standard monitoring is appropriate. However, the DNSBL listing and geolocation inconsistencies warrant continued observation.

RISK ASSESSMENT

Overall Risk Score: 25 (Low Risk)

Classification: Minimal Threat

Confidence: Data shows consistent low-risk behavior with no active malicious indicators

SOC ANALYST NOTES

The IP address 102.212.183.94 demonstrates minimal malicious activity. The single DNSBL listing and geolocation inconsistencies should be monitored but do not currently indicate active threats. No blocking or filtering is recommended at this time, but the address should remain on observation lists for future reference.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.