103.126.149.157📋 Copy

# THREAT INTELLIGENCE BRIEFING

Target: 103.126.149.157/32

Classification: Low Risk | Jurisdiction: Bangladesh (BD)

Date: Current Analysis Period

## Executive Summary

The target IP address 103.126.149.157 is classified as low risk with a risk score of 25/100. No active threat indicators, blacklists, or malicious campaigns were identified. The IP belongs to network WSCL-BD (ASN 138474) operated by IRT-WSCL-BD, registered under APNIC in Rajshahi Division, Bangladesh.

## Technical Profile

Network Ownership:

• ASN: 138474 (IRT-WSCL-BD)
• CIDR: 103.126.149.0/24
• RIR: APNIC
• Abuse Contact: abuse@windstreamcommunication.net

Geolocation:

• Country: Bangladesh (BD)
• Region: Rajshahi Division
• City: Rajshahi
• Coordinates: 24.36°N, 88.61°E

Network Role & Services:

• Service Status: Firewalled / No Services Detected
• Open Ports: None
• DNS Resolution: No PTR records, no forward resolution
• TLS/HTTP: No certificates, no web services

Control Plane:

• DNSBL Listings: 1 of 8 lists (12.5% coverage)
• Route Stability: Unstable
• BGP Prefix: 103.126.149.0/24
• RPKI/Irr Consistency: Not assessed

## Threat Assessment

Current Risk Score: 25 (Low Risk)

• Threat Indicators: None
• Blacklist Count: 0
• Known Campaigns: None
• Tor Exit: No
• Known Attacker: No
• Spam Source: No

Historical Analysis:

• Total Observations: 12 signals recorded
• Threat Persistence Days: 0
• Ownership Changes: 0
• Classification: Not persistently malicious

Subnet Neighborhood (103.126.149.0/24):

• Abuse Density: 0 (Clean)
• Total Siblings: 3
• Active Siblings: 0
• Threat Siblings: 0
• Notable Neighbor: 103.126.149.156 (Risk Score: 40, Authority Score: 50)

## Relationship Graph

• Same Network: WSCL-BD (2 instances)
• No external entity relationships detected

## Recommended Actions

SOC/Defense Recommendations:

1. Monitor subnet 103.126.149.0/24 for emerging threats; neighbor 103.126.149.156 shows elevated risk (40/100)

2. No immediate blocking required for target IP (25/100 risk score)

3. Investigate DNSBL listing context if false positives impact network operations

4. Track ownership stability; no changes observed during observation period

5. Continue monitoring for service changes (currently firewalled/no services)

Firewall Rules:

• No immediate allow/deny rules recommended based on current risk profile
• Consider monitoring neighbor IP 103.126.149.156 for potential coordinated activity

## Conclusion

IP 103.126.149.157 presents a low-risk profile with no active threat indicators. The subnet maintains a clean classification with no active threat siblings. SOC teams should monitor the associated subnet for any risk escalation, particularly the neighbor IP 103.126.149.156 which carries a medium-risk score of 40.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.