103.191.123.6📋 Copy

# IP Intelligence Briefing: 103.191.123.6/32

## Executive Summary

IP address 103.191.123.6 presents a Moderate Risk profile (Risk Score: 50/100) with no active threat indicators. The IP is currently firewalled with no open services, and belongs to a subnet with low abuse density (0.00). Recommended action: Block at perimeter firewall level due to DNSBL listings.

---

## Risk Assessment

Threat Indicators: None active. IP is not identified as:

• Tor exit node
• Known attacker
• Spam source
• Active attacker

---

## Network Classification

Control Plane Status:

• Route stability: Unstable
• RPKI State: Not validated
• Route changes (30d): 0
• DNSSEC: Valid
• IRR Consistency: N/A

---

## Geolocation Data

No geolocation data available. The IP lacks PTR hostname resolution and forward DNS confirmation.

---

## Service & Port Analysis

• Open Ports: None detected
• TLS Certificate: None
• HTTP Banner: None
• DNS Records: No PTR hostnames, no forward resolution

The IP is currently firewalled with no accessible services.

---

## Historical Observations

Seven observation signals recorded, with the following key findings:

• Subnet Classification: Clean
• Inherited Risk: 1
• Total Siblings: 26
• Active Siblings: 23
• Threat Siblings: 1

The subnet 103.191.123.0/24 demonstrates low threat activity with only one threatening sibling IP.

---

## Neighborhood Analysis

Subnet: 103.191.123.0/24

• Neighbor Count: 25 siblings
• Abuse Density: 0 (low risk environment)
• Risk Distribution:

- High Risk: 0

- Medium Risk: 2

- Low Risk: 22

Notable Neighbors:

• 103.191.123.67: Risk Score 40
• 103.191.123.132: Risk Score 40
• Remaining neighbors: Risk Score 0-25

---

## Relationships

No relationships discovered (certificates, organizations, hostnames, or correlated subnets).

---

## Recommended Security Actions

Firewall Rules

```bash

# iptables

iptables -A INPUT -s 103.191.123.6 -j DROP

# nftables

nft add rule inet filter input ip saddr 103.191.123.6 drop

# pfSense

103.191.123.6/32

```

WAF Rules

Cloudflare WAF: Block with expression `ip.src eq 103.191.123.6`

AWS WAF: Addresses `103.191.123.6/32` with description "IPDebrief risk 50"

---

## Intelligence Narrative

The target IP 103.191.123.6 exhibits a moderate risk profile primarily driven by historical DNSBL listings (2 of 8 total lists) rather than active malicious behavior. The IP is currently firewalled with no open ports or services accessible. The surrounding subnet demonstrates a clean operational environment with only 1 of 26 sibling IPs flagged as threatening.

Despite the moderate risk score, no active attack campaigns, known malware distribution, or infrastructure-based threats have been identified. The absence of ASN, organization, or geolocation data limits attribution capabilities. The IP should be blocked at the perimeter level due to DNSBL presence, though the lack of active threat indicators suggests this is a precautionary measure rather than an immediate threat response.

---

*Report generated: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.