103.157.200.34📋 Copy

# Threat Intelligence Briefing: 103.157.200.34/32

Date: 2026-07-27

Classification: Low Risk

Risk Score: 25/100

---

## Executive Summary

IP address 103.157.200.34 is registered to IRT-LOGITECH-PK (ASN 141372) in Pakistan (PK). The address shows low-risk characteristics with no active threat indicators, but exhibits minimal DNSBL listings and route instability. The /24 subnet demonstrates moderate abuse density with multiple medium-risk neighbors, warranting contextual monitoring.

---

## Network Ownership & Registration

• Organization: IRT-LOGITECH-PK
• Netname: LOGITECH-PK
• ASN: 141372
• CIDR Block: 103.157.200.0/24
• RIR: APNIC
• Abuse Contact: Available via RDAP
• Geolocation: Pakistan (30°N, 70°E)

---

## Threat Assessment

• Reputation: Low Risk
• Risk Score: 25
• Blacklist Count: 0
• Known Campaigns: None detected
• Tor Exit Node: No
• Spam Source: No
• Known Attacker: No

Control Plane Indicators

• DNSBL Listings: 1 of 8 lists (dnsblListedCount: 1)
• Operator Score: 0.1304 (Minimal)
• Route Stability: Unstable (isRouteStable: false)
• RPKI State: Not evaluated
• IRR Consistency: Not evaluated

---

## Network Services & Behavior

• Open Ports: None detected
• Service Purpose: Firewalled / No Services
• DNS Resolution: Failed (forwardConfirmed: false)
• PTR Hostnames: None
• HTTP/TLS: No services detected
• Total Incidents: 0
• WAF Violations: 0

---

## Neighborhood Analysis (103.157.200.0/24)

• Subnet Classification: Mostly Clean
• Abuse Density: 0.1429
• Total Siblings: 7
• Active Siblings: 2
• Threat Siblings: 1
• Inherited Risk: 2

Notable Neighbors by Risk Score

Three neighbors exhibit elevated risk scores (40), indicating moderate threat activity within the subnet.

---

## Historical Observations

• Total Observations: 13
• Threat Persistence: None detected
• Ownership Changes: 0
• Latest Activity: Port scanning activity observed (2026-07-27 22:19:24 UTC)
• Geolocation: Confirmed Pakistan (confidence: 0.70)
• Organization Data: Verified IRT-LOGITECH-PK (confidence: 0.90)

---

## Relationships

• Same Network: LOGITECH-PK (2 relationships)
• No additional entities: No associated hostnames, certificates, or organizations beyond network-level affiliation

---

## Security Recommendations

1. Monitor: The subnet (103.157.200.0/24) shows elevated neighbor risk activity. Monitor for lateral movement or coordinated activity.

2. DNSBL Review: Investigate the single DNSBL listing to determine blacklist reason and affected feeds.

3. Route Stability: Address route instability by monitoring BGP prefix changes and confirming ASN registration consistency.

4. Block Decision: No immediate blocking recommended; risk score (25) remains below typical threshold (70+).

5. Neighbor Investigation: Investigate 103.157.200.37, 103.157.200.48, 103.157.200.49, and 103.157.200.126 for potential threat correlation.

---

## Conclusion

IP 103.157.200.34 represents a low-risk address with no active malicious indicators. The address belongs to a Pakistani hosting organization with minimal threat footprint. However, the subnet's elevated abuse density and multiple medium-risk neighbors suggest contextual monitoring is warranted. No immediate defensive action required.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.