103.174.102.42📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 103.174.102.42/32

Date: 2026-07-29

Classification: Moderate Risk (Score: 50/100)

---

## EXECUTIVE SUMMARY

IP 103.174.102.42 presents a moderate risk profile with no active threat indicators. The asset appears to be a firewalled infrastructure endpoint with minimal operator activity and no known malicious associations. Geolocation data shows conflicting signals requiring validation.

---

## OWNERSHIP & NETWORK CONTEXT

• ASN: 133719 (IDIGITAL / NOC ADMIN)
• Network: 103.174.102.0/23 (APNIC RIR)
• Classification: Infrastructure / Firewalled
• ISP: Provider infrastructure with minimal operator score (0.1304)

---

## THREAT INDICATORS

• Risk Score: 50/100 (Moderate)
• Blacklist Status: 2 DNSBL listings out of 8 total lists
• Known Campaigns: None identified
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Abuse Confidence: Not elevated

---

## GELOCATION INCONSISTENCY ALERT

Profile geolocation indicates US/New York, while historical observation data (2026-07-29 09:57:33 UTC) shows geolocation inference pointing to India (IN) with 0.52 confidence. This discrepancy warrants investigation and may indicate:

• Virtual/private hosting
• Misconfigured DNS/geo data
• Legitimate multi-region operations

---

## DNS & HOSTING

• Resolved Hostname: server1.wehear.in
• Email Authentication: SPF and DMARC configured
• Forward Resolution: Confirmed (1 hostname)
• Open Ports: None detected
• Services: Firewalled / No active services exposed

---

## NEIGHBORHOOD ANALYSIS

Subnet: 103.174.102.0/24

• Total Siblings: 3
• Active Siblings: 1
• Threat Siblings: 0
• Abuse Density: 0 (Clean)
• Neighbor Risk Scores:

- 103.174.102.136: 30/100 (Low)

- 103.174.102.204: 40/100 (Low)

---

## OBSERVATION HISTORY

• Total Observations: 17 signals
• Recent Activity: No persistent malicious behavior detected
• Threat Persistence: 0 days
• Ownership Changes: 0
• Route Stability: Stable (0 route changes in 30 days)
• Control Plane: RPKI validation pending, IRR consistency checkable

---

## RECOMMENDED ACTIONS

Current Risk Assessment: No immediate threat action required. However, the following controls are recommended:

---

## ANALYST NOTES

1. Monitor Geolocation Discrepancy: The US vs India location conflict should be validated through additional passive DNS or traceroute analysis.

2. No Active Threats: The IP has no known malicious associations. Firewall rules are probabilistic recommendations and should be reviewed against other intelligence.

3. Neighborhood Clean: The /24 subnet shows minimal abuse density with only 1 active sibling.

4. Email Infrastructure: The associated domain (wehear.in) has proper SPF/DMARC configuration, suggesting legitimate email hosting use case.

---

Status: MONITOR (No immediate blocking required)

Priority: LOW

Next Review: Recommended within 7-14 days or upon threat indicator escalation

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.