103.191.123.132📋 Copy

# IP Intelligence Briefing: 103.191.123.132

Classification: Residential Endpoint | Risk Profile: Low Risk | Authority Score: 50

## Executive Summary

Target IP 103.191.123.132 is classified as a residential endpoint with a low-risk profile. The address is registered to WALITELECOM-PK within the 103.191.122.0/23 CIDR block under APNIC RIR. Current threat indicators show no active malicious activity, though historical observations indicate periodic port scanning and minor blacklist listings.

## Technical Profile

Network Ownership & Registration:

• Organization: Wali Telecom administrator (WALITELECOM-PK)
• ASN: WELLNETWORKS-AS-AP (AS139043)
• RIR: APNIC
• CIDR Block: 103.191.122.0/23
• Registration Date: Allocated July 2022

Geolocation Data:

• Country: FR (France)
• Region: Lahore - Pakistan
• City: Marseille
• Note: Geolocation shows regional inconsistency requiring validation

Network Role Classification:

• Type: Residential Endpoint
• Services: No active open ports detected
• TLS/HTTP: No certificates or web services identified
• Proxy/Tor: Not identified as proxy or Tor exit node

## Threat Intelligence Indicators

Current Threat Status:

• Risk Score: 0
• Abuse Confidence Score: Not applicable
• Blacklist Count: 0 (current snapshot)
• Known Campaigns: None identified
• Tor Exit Node: No
• Known Attacker: No

Historical Activity (12 observations):

• Recent DNSSEC validation observed (confidence: 0.90)
• ASN attribution to WellNetworks (Private) Limited, PK
• Minor blacklist listings with high severity noted in recent timeframe
• Port scanning activity detected
• No persistent malicious behavior patterns

## Neighborhood Analysis (103.191.123.0/24)

Subnet Risk Distribution:

• Total Siblings: 26
• Abuse Density: 0
• High Risk: 0
• Medium Risk: 1
• Low Risk: 21

Target IP Position:

• Risk Score: 0
• Authority Score: 50
• Relative to subnet: Clean compared to several neighbors with risk scores of 25-40

## Security Recommendations

Immediate Actions: None required based on current risk profile.

Monitoring Considerations:

• Monitor for emergence of open ports or service changes
• Track blacklist status changes (historical listings present)
• Observe for any correlation with elevated-risk neighbors in the /24 subnet
• Validate geolocation consistency for operational context

Firewall/Threat Prevention: No blocking recommended. Standard residential endpoint traffic allowed.

## Intelligence Confidence

High – Multiple data sources confirm residential classification with no active threat indicators. Historical observations show benign activity patterns typical of residential ISP allocations.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.