103.76.215.102📋 Copy

# IP Intelligence Briefing: 103.76.215.102/32

Classification: LOW RISK (Score: 35/100)

Date: Current Observation Period

Analyst: SOC Intelligence

---

## EXECUTIVE SUMMARY

The IP address 103.76.215.102 presents as a low-risk web server endpoint associated with SPECTRACLOUD infrastructure. While the overall risk profile indicates minimal threat activity, control plane inconsistencies and DNSBL listings warrant continued monitoring. No active malicious indicators were detected.

---

## OWNERSHIP & INFRASTRUCTURE

The IP operates within a /24 subnet with zero neighboring active IPs and zero abuse density. No correlated IPs or campaign activity detected.

---

## GEOLOCATION ANALYSIS

Note: Geolocation data shows inconsistency between profile (India) and certificate metadata (France, CN=tst, O=common). This discrepancy warrants verification.

---

## THREAT INDICATORS

Control Plane Status:

• IRR Consistency: Conflict
• RPKI State: Not validated
• Route Stability: Inconsistent
• DNSSEC: Valid

---

## NETWORK SERVICES

TLS Certificate:

• Issuer: CN=tst, OU=user, O=common, C=FR
• Subject: CN=tst, OU=user, O=common, C=FR
• Algorithm: TLS_AES_256_GCM_SHA384
• Protocol: TLS 1.3

---

## OBSERVATION HISTORY

Total Observations: 14 signals recorded

Most Recent: 2026-07-30T16:02:28 UTC

Recent activity indicates stable web server operation with consistent HTTP 200 responses. TLS configuration and server fingerprints remain unchanged across observation window.

---

## SECURITY RECOMMENDATIONS

Based on risk profile and control plane conflicts, the following rules are recommended:

```bash

# iptables

iptables -A INPUT -s 103.76.215.102 -j DROP

# nftables

nft add rule inet filter input ip saddr 103.76.215.102 drop

```

Additional Platform Rules:

• Cloudflare WAF: Block (risk score 35)
• AWS WAF: Add to deny list (103.76.215.102/32)

SOC Action: Monitor for changes in geo-location consistency and DNSBL status. No immediate blocking required but maintain visibility on this endpoint.

---

## ASSESSMENT

This IP represents a legitimate web server with low observed risk. The IRR conflict and single DNSBL listing are passive indicators that do not currently constitute active threat behavior. Continue standard monitoring protocols.

Confidence Level: High (14 observations, consistent fingerprinting)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.