103.118.152.4📋 Copy

# IP Intelligence Briefing: 103.118.152.4

Classification: Moderate Risk

Date: 2026-07-29

Prepared For: SOC Analyst Team

---

## Executive Summary

IP address 103.118.152.4 is classified as moderate risk (Score: 50). The IP belongs to Nextgen Online administrator (ASN 137964) in Dhaka, Bangladesh. No active services or threat indicators detected. The subnet (103.118.152.0/24) demonstrates clean classification with zero abuse density.

---

## Ownership & Network Information

---

## Threat Indicators

Risk Profile:

• Risk Score: 50 (Moderate)
• Abuse Confidence Score: Not available
• Blacklist Count: 0
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No

Service Status:

• Open Ports: None detected
• TLS Certificate: Not present
• DNS Forward Resolution: Not confirmed
• Classification: Firewalled / No Services

---

## Neighborhood Analysis

Neighbor Risk Scores:

• 103.118.152.7: Risk 25, Authority 50
• 103.118.152.115: Risk 25, Authority 50
• 103.118.152.116: Risk 25, Authority 50

All neighboring IPs maintain low-risk profiles with no threat indicators.

---

## Observation History

Recent Signals (17 total observations):

• 2026-07-29 14:31:42 - Port scan activity detected (confidence: 0.70)
• 2026-07-29 14:31:31 - Geo signal observed (confidence: 0.90, RTT: 246.6ms)
• 2026-07-29 14:29:05 - Network classification (confidence: 0.30)
• 2026-07-29 14:28:12 - ASN signal (confidence: 0.85, age: 2940 days)
• 2026-07-29 14:28:12 - Route change detected (1 change in 30 days)

Temporal Status:

• Ownership changes: 0
• Threat persistence: 0 days
• Persistently malicious: No

---

## Control Plane Data

• BGP Prefix: 103.118.152.0/24
• Route Changes (30d): 1
• RPKI State: Not available
• IRR Consistency: Not available
• DNSBL Listed: 2 of 8 total lists

---

## Recommended Actions

No immediate action required. The IP demonstrates no active threat indicators, no open services, and a clean neighborhood profile. The moderate risk classification is likely due to historical DNSBL listings rather than current malicious activity.

Monitoring Recommendations:

• Continue passive monitoring for service changes
• Watch for route stability (1 change in 30 days)
• Monitor DNSBL status for any new listings

Firewall/Blocking: Not recommended at this time. The IP is not actively malicious and poses minimal threat to defensive infrastructure.

---

End of Briefing

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.