103.79.167.117📋 Copy

# IP INTELLIGENCE BRIEFING: 103.79.167.117/32

Date: 2026-07-31 | Classification: Moderate Risk | Risk Score: 50/100

---

## EXECUTIVE SUMMARY

IP address 103.79.167.117 belongs to organization NIXI (BHIMARBPL) within the 103.79.164.0/22 CIDR block, registered with APNIC. The IP presents moderate risk (50/100) with minimal operator activity. No active threat indicators or known malicious campaigns were detected. The address is firewalled with no open services, presenting limited immediate threat vector but warranting monitoring due to DNSBL listings.

---

## OWNERSHIP & GEOLOCATION

---

## THREAT INDICATORS

• Blacklist Count: 0 (active)
• Threat Feeds: None detected
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Abuse Confidence Score: Not applicable

DNSBL Status: Listed on 2 out of 8 monitored lists

---

## NETWORK CLASSIFICATION

• Infrastructure Type: Firewalled / No Services
• Cloud Provider: No
• CDN: No
• VPN/Proxy: No
• Tor Network: No
• Hosting Service: No
• Mobile/Residential: No
• Anycast: No
• Bogon Address: No

---

## SERVICES & PORTS

• Open Ports: None detected
• TLS Certificates: None
• HTTP Title: None
• Server Banner: None
• Email Auth (SPF/DMARC): Not configured

---

## CONTROL PLANE ANALYSIS

---

## NEIGHBORHOOD ANALYSIS

• Subnet: 103.79.167.0/24
• Abuse Density: 0
• Total Siblings: 1
• Active Siblings: 0
• Threat Siblings: 0
• Neighbor IP: 103.79.167.181 (Risk Score: 25, Authority Score: 50)

---

## OBSERVATION HISTORY

• Total Observations: 12
• Recent Activity: 2026-07-31
• Threat Persistence Days: 0
• Ownership Changes: 0
• Persistently Malicious: No

Signal confidence ranged from 0.21 to 0.85 across observation types (ownership, network role, services, DNSSEC operator score).

---

## RELATIONSHIP GRAPH

• Total Relationships: 4
• All Relationships: Same Network (BHIMARBPL)
• No external entity links detected (no hostnames, certificates, or organizations outside the network)

---

## RECOMMENDED SECURITY ACTIONS

Firewall Rules (Recommended for Immediate Deployment)

iptables:

```bash

iptables -A INPUT -s 103.79.167.117 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 103.79.167.117 drop

```

Cloudflare WAF:

```json

{

"description": "Block 103.79.167.117 — IPDebrief risk score 50",

"action": "block",

"filter": {

"expression": "ip.src eq 103.79.167.117"

}

}

```

AWS WAF:

```json

{

"Addresses": ["103.79.167.117/32"],

"Description": "IPDebrief risk 50"

}

```

---

## INTELLIGENCE ASSESSMENT

The IP address 103.79.167.117 presents a moderate risk profile with no active threat indicators. The moderate risk score (50/100) is primarily driven by DNSBL listings rather than observed malicious behavior. The address is firewalled with no services, eliminating traditional attack vectors.

Key Findings:

1. No known malicious activity or campaigns associated

2. Minimal operator activity detected (0.1304 score)

3. No neighboring IPs showing elevated threat levels

4. Static ownership with no recent changes

5. DNSSEC validation enabled indicates some operational security posture

Recommendation: Monitor but no immediate blocking required unless additional threat intelligence emerges. The moderate risk rating warrants inclusion in watch

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.