103.143.12.43📋 Copy

## IP Intelligence Briefing: 103.143.12.43/32

Classification: Moderate Risk

Analysis Date: Current

Target: 103.143.12.43

Executive Summary

IP address 103.143.12.43 presents a moderate risk profile (Risk Score: 50) with conflicting geolocation data and DNSBL listings. The IP is assigned to IRT-HONGKONG5-HK (ASN: 138115) within the IPXO network (103.143.12.0/24) under APNIC. No open services detected; the endpoint is firewalled. Historical data indicates variable geolocation reporting and proxy/VPN classification in recent observations.

Risk Indicators

• Risk Score: 50/100 (Moderate)
• DNSBL Status: Listed on 2 of 8 DNS blacklists (dnsblListedCount: 2)
• Blacklist Count: 0 (contradiction with DNSBL data requires investigation)
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Abuse Confidence Score: Not available
• Operator Score: 0.2609 (Basic)

Network Classification

• Organization: IRT-HONGKONG5-HK
• Network: 103.143.12.0/24 (IPXO)
• ASN: 138115
• RIR: APNIC
• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• TLS Certificates: None
• Cloud/CDN/Proxy/VPN: All false (per primary profile)

Geolocation Discrepancy

Significant conflict exists in geolocation data:

• Primary profile indicates: London, GB (Europe/London timezone)
• Historical signal indicates: Hong Kong, HK
• Geographic consensus: False (geoConsensus: false)
• Two geolocation sources disagree

DNS Analysis

• PTR Record: 103-143-12-43.domainesia.io
• Forward Resolution: Confirmed
• Hosted Domain: domainesia.io
• Email Authentication: No SPF or DMARC records
• DNSSEC: Valid
• CAA Record: None

Behavioral Indicators

• Open Ports: None
• TLS Certificate: None
• HTTP Banner: None
• HSTS/CSP: Not present
• Honeypot Hits: 0
• Threat Persistence Days: 0

Historical Observations (15 signals)

Recent history shows:

• Multiple geolocation signals with conflicting country assignments (GB vs HK)
• One proxy/VPN detection with risk score 66 (source: proxycheck-io)
• RIR assignments consistently APNIC
• Various confidence levels across signal types (0.12–0.95)

Network Relationships

• DNS Association: 103-143-12-43.domainesia.io
• Network Association: IPXO (103.143.12.0/24)

Neighborhood Analysis (103.143.12.0/24)

• Total Siblings: 6
• Abuse Density: 0
• Risk Distribution:

- High Risk: 0

- Medium Risk: 1 (103.143.12.153, Score: 40)

- Low Risk: 5 (remaining neighbors)

• Neighbor Risk Scores: Range from 0–40; no high-risk neighbors identified

Traceroute Analysis

• Hop Count: 17
• First Hop RTT: 0.1ms
• Last Hop RTT: 260.7ms
• Timed Out Hops: 2
• Transit Networks: Comcast, Cogent

Recommended Actions

Based on the moderate risk profile and DNSBL listings, the following defensive measures are recommended:

1. Firewall Rules: Block inbound traffic from 103.143.12.0/24 if the IP is observed initiating connections to internal resources.

2. Monitoring: Implement enhanced logging for any traffic involving this IP, given the geolocation discrepancies and DNSBL presence.

3. DNS Policy: The domainesia.io hostname lacks SPF and DMARC records; verify whether this resolves to legitimate services before allowing email authentication.

4. Neighbor Assessment: No immediate escalation needed based on subnet analysis; only one medium-risk neighbor identified.

Threat Assessment

This IP is not currently flagged as an active attacker, spam source, or Tor exit node. The primary concerns are the DNSBL listings and geolocation inconsistencies. The subnet shows low abuse density with no high-risk neighbors. Continued monitoring is advised pending clarification of geographic origin and DNSBL listing rationale.

---

*Generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.