103.79.17.139📋 Copy

# INTELLIGENCE BRIEFING: IP 103.79.17.139/32

Classification: MODERATE RISK | Date: Current Intelligence Cycle

Prepared For: SOC Operations Team | Status: REQUIRES MONITORING

---

## EXECUTIVE SUMMARY

Target IP 103.79.17.139 is a web server infrastructure endpoint operated by IRT-SHARPCOM-PK (ASN 138453) within the SHARPCOM-PK network (103.79.16.0/22). The IP exhibits a risk score of 50/100, classified as Moderate Risk, with no active threat indicators but notable presence in DNSBL listings. Infrastructure is hosted in Pakistan with Microsoft IIS/10.0 serving web traffic.

---

## OWNERSHIP & GEOLOCATION

---

## INFRASTRUCTURE PROFILE

Network Services:

• Open Ports: TCP/80 (HTTP), TCP/443 (HTTPS)
• Server: Microsoft-IIS/10.0
• HTTP Version: 2.0
• TTFB: 844ms

SSL/TLS Certificate:

• Issuer: CN=Certera RSA DV SSL CA 2, O=Certera LLC, C=US
• Subject: CN=oms2.leopardsoms.pk
• SANs: oms2.leopardsoms.pk, www.oms2.leopardsoms.pk
• Certificate Type: Not self-signed

Security Headers:

• HSTS: Enabled (max-age=2592000)
• HTTP/2: Supported
• X-Frame-Options: DENY
• CSP: Not configured
• Referrer Policy: Not configured

---

## THREAT ASSESSMENT

Risk Indicators:

• Risk Score: 50 (Moderate)
• Abuse Confidence: Not applicable
• Blacklist Status: Listed on 2 of 8 DNSBL lists
• Campaign Affiliation: None identified
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No

Control Plane Status:

• Route Stability: False
• DNSSEC: Valid
• Operator Score: 0.1304 (Minimal)
• RPKI State: Not determined

---

## OBSERVATION HISTORY

Total Signals Observed: 13

Latest Observation: 2026-07-31

Temporal Analysis:

• Threat Persistence Days: 0
• Is Persistently Malicious: No
• Ownership Changes: 0
• Average Ownership Days: Not determined

Signal Types Monitored:

• HTTP Response Characteristics
• Network Classification
• TLS Certificate Validity
• Geolocation Data
• Port Scanning Activity

---

## NEIGHBORHOOD ANALYSIS

Subnet: 103.79.17.0/24

Abuse Density: 0.0

Total Siblings: 2

Assessment: Subnet exhibits low abuse density with no high-risk neighbors. Target IP is an outlier within its immediate subnet.

---

## RELATIONSHIP MAPPING

Identified Relationships: 5

Primary Association: SHARPCOM-PK Network (Multiple same-network references)

All relationships map to the same network entity, indicating consistent infrastructure hosting.

---

## RECOMMENDED ACTIONS

Current Risk-Based Recommendations:

Operational Guidance: These recommendations are probabilistic. Combine with additional threat signals before implementing blocking measures. Monitor for legitimate business traffic from this IP range.

---

## INTELLIGENCE CONCLUSION

IP 103.79.17.139 presents moderate risk due to DNSBL presence but lacks active threat indicators. The infrastructure appears to be a legitimate web hosting endpoint for oms2.leopardsoms.pk. Recommend monitoring rather than immediate blocking unless additional threat intelligence emerges. Subnet context shows no correlated malicious activity from neighboring IPs.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.