103.109.186.231📋 Copy

IP INTELLIGENCE BRIEFING: 103.109.186.231/32

---

**Executive Summary**

IP address 103.109.186.231 presents a moderate risk profile (risk score: 50) originating from Vietnam. The IP operates as a web server with standard service ports but exhibits no confirmed malicious activity. The subnet classification is clean with zero threat siblings, though DNSBL listings indicate some reputation concerns across 2 of 8 evaluated lists.

---

**Network Ownership & Registration**

---

**Technical Profile**

---

**Threat Intelligence Assessment**

• Reputation: Moderate Risk (50/100)
• Threat Indicators: None detected
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0 (DNSBL: 2/8 lists)
• Persistent Malicious Activity: No

---

**Neighborhood Analysis**

Subnet: 103.109.186.0/24

• Abuse Density: 0 (Clean)
• Total Siblings: 2
• Active Siblings: 2
• Threat Siblings: 0
• Neighbor IP: 103.109.186.174 (Risk Score: 25, Authority Score: 50)

The subnet demonstrates low overall abuse density with no correlated malicious activity in adjacent addresses.

---

**Observation History**

Total observations: 15

• Recent Activity: Most recent signal observed 2026-07-30T01:41:40 UTC
• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 0
• Status: No persistent malicious behavior detected

---

**Recommended Security Actions**

Risk Score: 50 (Moderate)

While no explicit threat indicators are present, the moderate risk score warrants consideration for blocking:

Note: These recommendations are probabilistic. Combine with additional telemetry and threat intelligence before implementing blocking rules.

---

**Intelligence Narrative**

This IP address represents infrastructure hosted within a Vietnamese network block under IRT-VNNIC-AP. The system runs standard web server software with valid SSL certificates. While the subnet shows clean classification and no active threat siblings, the moderate risk score and presence on multiple DNSBLs suggest potential for abusive activity. The absence of historical threat persistence indicates this IP has not been observed in sustained malicious campaigns. Network defenders should weigh the moderate risk score against operational requirements, considering that the IP may be misconfigured or underutilized rather than actively malicious.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.