103.167.89.222📋 Copy

# IP INTELLIGENCE BRIEFING: 103.167.89.222/32

## Executive Summary

IP address 103.167.89.222 is a Vietnamese-based web server with an elevated risk score of 65/100. The IP belongs to JOBKEY-VN (ASN: 151858) within the APNIC RIR. While the subnet shows low abuse density, the IP presents moderate threat indicators including multiple DNSBL listings and historical threat signals. Recommended action: monitor closely or block depending on organizational threat posture.

---

## Ownership & Registration

---

## Threat Assessment

• Risk Score: 65/100 (Moderate Risk)
• Abuse Confidence Score: Null
• Blacklist Count: 0
• DNSBL Listings: 3 of 8 total lists
• Tor Exit/Proxy/VPN: No
• Known Attacker: False
• Spam Source: False

Historical Threat Signals

• 23 total observations recorded
• Recent signals include routing anomalies and threat indicators
• One observation showed high-severity DNSBL listings
• ASN-level pulse count: 32 associated threat pulses

---

## Network Services & Infrastructure

TLS Certificate

• Issuer: Let's Encrypt
• Subject: mategourd.vn
• Domains: mategourd.vn, www.mategourd.vn
• Certificate Age: Active

Server Fingerprint

• Web Server: nginx
• HTTP Version: 2.0
• HSTS: Enabled
• HTTP/2: Enabled

---

## DNS Analysis

• PTR Hostnames: None resolved
• Forward Resolution: No entries
• Hosted Domains: 0
• Email Authentication (SPF/DMARC): Not configured
• DNSSEC Valid: Yes

---

## Subnet Neighborhood Analysis

• Subnet: 103.167.89.222/24
• Abuse Density: 0 (Clean)
• Threat Siblings: 0
• Classification: Clean

---

## Recommended Security Actions

Monitoring (High Priority)

Increase logging verbosity and review recent activity from this IP due to elevated risk score (65/100).

Firewall Rules

```bash

# iptables

iptables -A INPUT -s 103.167.89.222 -j DROP

# nftables

nft add rule inet filter input ip saddr 103.167.89.222 drop

# nginx

deny 103.167.89.222;

```

Cloud Security Platforms

• Cloudflare WAF: Block with expression `ip.src eq 103.167.89.222`
• AWS WAF: Add address 103.167.89.222/32 with description "IPDebrief risk 65"

---

## Intelligence Narrative

The IP 103.167.89.222 operates as a public-facing web server in Vietnam under the JOBKEY-VN organization. Despite showing no active campaigns or known attacker signatures, the moderate risk score (65) stems from historical DNSBL listings and elevated threat pulse counts at the ASN level. The subnet itself remains clean with no neighboring threats, suggesting the risk is isolated to this specific IP. The IP lacks email authentication and has multiple DNSBL associations, indicating prior abuse history. Recommended defensive posture: monitor activity patterns for escalation or block if organizational policy requires pre-emptive mitigation against IPs with risk scores exceeding 60.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.