103.186.1.158📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Subject: 103.186.1.158/32

Classification: Moderate Risk

Report Date: 2026-07-22

---

## EXECUTIVE SUMMARY

IP address 103.186.1.158 is a moderate-risk (risk score: 40) residential infrastructure endpoint located in Sukabumi, Indonesia. The IP is associated with ASN 136052 (Iman Sukma Firmansyah) under the IDNIC-ANSA-ID network. No active threat indicators, known campaigns, or blacklist entries were observed. The endpoint shows minimal operator-level risk (operator score: 0.1304) and no persistent malicious behavior.

---

## OWNERSHIP & GEOLOCATION

Geolocation Validation: Geographic data sourced from multiple providers (geo consensus confirmed). Coordinates inferred at -0.79, 113.92 with 1500km accuracy radius.

---

## NETWORK CHARACTERISTICS

Service Status: Firewalled / No Services Detected

Open Ports: None

DNS Records:

• PTR: ip103-186-1-158.cloudhost.web.id
• Forward Resolution: ip103-186-1-158.cloudhost.web.id
• Forward Confirmed: No
• SPF/DMARC: Not configured

BGP Control Plane:

• Route Stable: No
• Route Changes (30d): 0
• MOAS: No
• DNSSEC Valid: Yes

---

## THREAT ASSESSMENT

Threat Evidence: No active threat indicators identified. No association with known malicious campaigns or threat feeds.

---

## OBSERVATION HISTORY

Total Observations: 14 signals

Recent Activity: 2026-07-22 (most recent)

Ownership Stability: 0 ownership changes (stable)

Threat Persistence: 0 days

Persistently Malicious: No

Observations show consistent geolocation and ownership data with no significant temporal shifts in threat profile.

---

## SUBNET ANALYSIS (103.186.1.0/24)

Total Neighbors: 8

Abuse Density: 0%

Risk Distribution:

• High Risk: 0
• Medium Risk: 8
• Low Risk: 0

Notable Neighbor IPs:

• 103.186.1.103 (Risk: 65)
• 103.186.1.197 (Risk: 65)
• All remaining siblings: Risk 40

The /24 subnet demonstrates uniform medium-risk classification with no high-risk outliers.

---

## RELATIONSHIP GRAPH

Connected Entities:

1. Network: IDNIC-ANSA-ID (Same Network)

2. DNS Hostnames:

- ip103-186-1-158.cloudhost.web.id (DNS Association)

No additional organizational or certificate relationships detected.

---

## RECOMMENDED ACTIONS

Risk Score: 40 — Blocking recommended based on current risk profile.

Firewall Rules (Approved):

```bash

# iptables

iptables -A INPUT -s 103.186.1.158 -j DROP

# nftables

nft add rule inet filter input ip saddr 103.186.1.158 drop

# nginx

deny 103.186.1.158;

# pfSense

103.186.1.158/32

# Cloudflare WAF

{

"description": "Block 103.186.1.158 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 103.186.1.158"

}

}

# AWS WAF

{

"Addresses": ["103.186.1.158/32"],

"Description": "IPDebrief risk 40"

}

```

---

## ANALYST NOTES

This IP represents residential infrastructure with moderate risk classification. While no active malicious indicators are present, the moderate risk score (40) combined with the subnet's uniform medium-risk profile warrants blocking per organizational security policy. Monitor for changes in DNSBL listings or threat indicator emergence.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.