103.109.56.189📋 Copy

# IP Intelligence Briefing: 103.109.56.189/32

Classification: Moderate Risk | Last Updated: 2026-07-18

---

## Executive Summary

IP address 103.109.56.189 is classified as moderate risk (score: 55/100) with no currently active services detected. The address is geolocated to Bangladesh and associated with ASN 138640 (SKYNET CHOWMUHANI). The IP has been listed on 3 DNSBL entries with high severity ratings. No open ports or TLS services are detected, suggesting the host is either non-operational or firewalled.

---

## Ownership & Geolocation

The IP resides within the SKYNET CHOWMUHANI-BD network block (103.109.56.0/24) registered under APNIC.

---

## Threat Indicators

• DNSBL Listings: 3 of 8 total lists (high severity)
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Blacklist Count: 0
• Campaign Correlation: None identified

---

## Network Behavior

• Service Status: Firewalled / No Services Detected
• Open Ports: None
• TLS Certificates: None
• HTTP Banner: None

The absence of open ports suggests minimal attack surface, though DNSBL presence indicates prior abusive behavior.

---

## Neighborhood Analysis

The /24 subnet (103.109.56.0/24) shows:

• Abuse Density: 0%
• Active Siblings: 0
• Threat Siblings: 0
• Total Siblings: 0

No neighboring IP addresses in the same subnet were identified with risk scores.

---

## Historical Observations

Nine signal observations recorded, most recent on 2026-07-18. Key historical signals include:

1. Ownership Data (2026-07-18): Consistent registration with SKYNET CHOWMUHANI administrator

2. Geolocation (2026-07-18): Bangladesh (BD) consensus

3. DNSBL Listings (2026-07-18): 3 listings with high severity

4. DNSSEC Validity: Confirmed

---

## Recommended Actions

Based on the moderate risk profile and DNSBL listings, the following defensive measures are recommended:

1. Monitor DNSBL Status: Track the three blacklist entries for changes or removal requests

2. Implement Rate Limiting: Apply connection rate limits to mitigate potential abuse from this subnet

3. Block if Applicable: Consider blocking at perimeter if traffic patterns indicate malicious intent

4. Log All Traffic: Enable detailed logging for forensic analysis if the IP is allowed through

---

## Intelligence Assessment

The IP address presents a moderate risk profile primarily due to DNSBL listings. The absence of open services and low neighborhood risk suggests limited active threat capability. However, the presence on multiple DNSBLs with high severity indicates historical abuse. Continuous monitoring is advised, particularly for any changes in service status or new threat indicator emergence.

Confidence Level: High (based on consistent ownership and geolocation data across multiple observations)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.