103.30.195.219📋 Copy

# IPDEBRIEF THREAT INTELLIGENCE BRIEFING

## Target: 103.30.195.219/32

EXECUTIVE SUMMARY

This IP address presents as a low-risk, legitimate web hosting endpoint with minimal threat indicators. Risk assessment: LOW RISK (Score: 25/100). No active malicious activity detected.

---

## RISK PROFILE

Key Risk Indicators

• No active threat indicators present
• Not classified as known attacker, spam source, or Tor exit node
• No associated threat campaigns
• No persistent malicious observations recorded

---

## OWNERSHIP & GEOLOCATION

Route Stability

• BGP Prefix: 103.30.195.0/24
• Route Changes (30d): 0
• Route Stability: False
• RPKI State: Not evaluated

---

## NETWORK INFRASTRUCTURE

Services & Ports

Server Fingerprint

• Web Server: nginx
• HTTP/2: Enabled
• HSTS: Enabled (max-age=31536000)
• TLS Certificate: Let's Encrypt (CN=educacionactiva.org)
• Certificate Subject: educacionactiva.org

DNS Configuration

• PTR Hostname: ip103-30-195-219.cloudhost.web.id
• Forward Resolution: ip103-30-195-219.cloudhost.web.id
• Domain: web.id
• Hosted Domains: educacionactiva.org
• DNSSEC: Valid
• SPF/DMARC: Not configured

---

## THREAT INDICATORS

Threat Feeds

• Pulsedive Risk: Not applicable
• Known Campaigns: None
• Blacklist Count: 0 active

---

## NEIGHBORHOOD ANALYSIS

Notable Neighbor

• 103.30.195.72: Risk Score 25, Authority Score 50

---

## OBSERVATION HISTORY

Recent Activity (2026-07-29)

• 20 total observations recorded
• Ownership stability: No changes detected
• Threat persistence days: 0
• Is persistently malicious: False

HTTP Performance Metrics

• Response time: 3602ms (elevated latency observed)
• HTTP Version: 2.0
• Cache Status: No cache hits recorded
• Server Response: 200 OK

Network Tracing

• Total hops: 24
• Target reached: Yes
• Traced at: 2026-07-29T03:29:44 UTC

---

## RELATIONSHIP GRAPH

Network Associations

• IANA-BLOCK: Same network classification (2 associations)

DNS Associations

• ip103-30-195-219.cloudhost.web.id: 6 DNS association records

---

## RECOMMENDED ACTIONS

Firewall/Block List Recommendations

Current Status: No immediate blocking required

Considerations for Security Operations:

1. DNSBL Check: 1 listing detected out of 8 evaluated lists – monitor for changes

2. SSH Access: Port 22 open – verify if expected for legitimate purposes

3. Latency: 3.6s response time – investigate if this impacts user experience

Monitoring Priorities

• Track DNSBL listing status changes
• Monitor for new threat indicators
• Watch neighborhood subnet for emerging threats

---

## INTELLIGENCE ASSESSMENT

Classification: LEGITIMATE HOSTING ENDPOINT

Confidence: HIGH (Low risk score, clean neighborhood, no threat indicators)

Summary: IP 103.30.195.219 operates as a legitimate web hosting service for the domain educacionactiva.org. The endpoint shows no evidence of malicious activity, with standard web services (HTTP/HTTPS) and administrative access (SSH) open. The Indonesian origin (APNIC registry) aligns with the infrastructure provider IRT-IDNIC-ID. The single DNSBL listing requires monitoring but does not currently warrant blocking.

Threat Level: LOW – No defensive action required at this time.

---

*Report generated: 2026-07-29 | Data Source: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.