103.147.248.44📋 Copy

# IP Intelligence Briefing: 103.147.248.44/32

## Executive Summary

IP 103.147.248.44 is classified as High Risk (Score: 80/100) despite operating within a subnet showing low abuse density. The address belongs to ASN 153283 (IRT-SOFTCROP-IN) and is registered to SOFTCROP network in Assam, India. While no direct threat indicators or known campaigns were identified, the IP is listed on 5 of 8 DNSBLs and exhibits characteristics warranting monitoring.

## Network Profile

• ASN: 153283 (IRT-SOFTCROP-IN)
• Network: SOFTCROP (103.147.248.0/23)
• Geolocation: Assam, Kamrup Metropolitan District, India (IN)
• Service Role: Web Server (HTTP/HTTPS)
• Control Plane: Route stable, DNSSEC valid, CAA records present

## Technical Indicators

• Open Ports: TCP/80, TCP/443
• Server Banner: nginx
• TLS Certificate: CN=uservsftpd (issuer and subject match; certificate validity requires validation)
• HTTP Version: 1.1
• HSTS: Enabled (max-age=63072000)
• Powered By: Express.js

## Threat Assessment

• DNSBL Listings: 5 of 8 total lists
• Abuse Confidence Score: Not computed
• Known Attacker: False
• Tor Exit Node: False
• Blacklist Count: 0 (DNSBL only)
• Threat Persistence: 0 days; not persistently malicious
• Threat Observation Count: 1

## Temporal Analysis

Historical observation data spans 26 observations with recent activity recorded on 2026-06-17. HTTP fingerprinting confirms nginx serving Express.js applications with HTTP/1.1. TLS 1.2 cipher suite (TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) indicates reasonable encryption posture. HSTS enforcement is active.

## Neighborhood Context

The /24 subnet (103.147.248.0/24) shows:

• Abuse Density: 0 (classification: mostly_clean)
• Active Siblings: 0
• Neighbor Risk: One neighboring IP (103.147.248.23) with risk score 70

The discrepancy between individual IP risk (80) and subnet abuse density (0) suggests isolated activity rather than coordinated subnet-level abuse.

## Relationship Graph

29 relationships identified, primarily same-network associations with SOFTCROP. DNS association records indicate resolution attempts to internal address 192.168.2.108#53, likely local DNS infrastructure references.

## Recommended Actions

• Monitoring: Flag for ongoing observation due to DNSBL presence despite lack of direct threat indicators
• Firewall: No immediate blocking recommended; monitor for behavioral patterns
• Investigation Priority: Medium – investigate DNSBL listing sources and certificate validity
• Correlation: Review traffic patterns to 103.147.248.23 (neighbor IP with risk score 70)

## Intelligence Narrative

This IP represents a high-risk web server endpoint with elevated reputation scores but limited direct threat attribution. The combination of DNSBL listings and Express.js application hosting suggests potential misuse or reputation degradation. The subnet-level cleanliness indicates this risk is not shared across the SOFTCROP network. SOC analysts should monitor for activity patterns and validate the nature of DNSBL listings before implementing blocking measures.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.