103.84.198.252📋 Copy

INTELLIGENCE BRIEFING: 103.84.198.252/32

Classification: Low Risk

Date: 2026-07-23

Prepared for: SOC Analysts

---

**1. EXECUTIVE SUMMARY**

IP 103.84.198.252 is a low-risk residential/fixed-line endpoint assigned to SRI DATTATREYA (ASN 45916) in Surat, Gujarat, India. The IP shows no active threat indicators, no open services, and minimal neighborhood abuse density. No immediate defensive actions recommended beyond standard baseline monitoring.

---

**2. NETWORK OWNERSHIP & GEOLOCATION**

• ASN: 45916 (SRI DATTATREYA)
• Network Block: 103.84.198.0/23
• Organization: SRI DATTATREYA
• Country: India (IN)
• Region/City: Gujarat, Surat
• RIR: APNIC
• Abuse Contact: abuse.report@gtpl.net

The IP operates under a legitimate cable/ISP infrastructure provider with stable regional assignment.

---

**3. RISK ASSESSMENT**

Risk Breakdown: The IP demonstrates no malicious behavior patterns. The single DNSBL listing shows minimal operator-level concern (score: 0.1304).

---

**4. THREAT INDICATORS & CAMPAIGNS**

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Known Campaigns: None
• Associated Certificates: None
• Correlated IPs: None

No threat feeds or campaign matches detected. The IP is not classified as a honeypot hit or enumeration strike target.

---

**5. NETWORK SERVICES & DNS**

• Open Ports: None detected
• DNS PTR: No reverse resolution
• Forward Resolution: Not confirmed
• Hosted Domains: 0
• Email Auth: SPF/DMARC not configured
• HTTPS/TLS: No certificates or banners

The endpoint appears firewalled with no active services exposed.

---

**6. NEIGHBORHOOD ANALYSIS (103.84.198.0/24)**

• Total Siblings: 3
• Active Siblings: 0
• Threat Siblings: 0
• Abuse Density: 0%

The /24 subnet maintains a clean risk profile with no high-risk neighbors detected.

---

**7. OBSERVATION HISTORY**

11 observations recorded on 2026-07-23:

• Ownership Signals: Consistent (SRI DATTATREYA)
• Geolocation: India (Gujarat/Surat) - Confidence: 52-95%
• Network Classification: Stable
• Threat Persistence: 0 days

No significant signal changes detected over the observation window.

---

**8. RELATIONSHIP GRAPH**

• Primary Relationship: Same Network (SRIDATTATREYACABLE)
• Related Entities: 1 network relationship
• No cross-organizational or certificate associations

---

**9. RECOMMENDED ACTIONS**

No immediate defensive actions required. The IP presents low-risk characteristics typical of legitimate residential/ISP infrastructure. Standard baseline monitoring is appropriate.

Optional Firewall Rule (if blocking required):

```

# Block only if policy mandates (low risk)

iptables -A INPUT -s 103.84.198.252/32 -j DROP

```

---

**10. INTELLIGENCE NOTES**

• IP is firewalled with no services detected
• No active threat indicators or campaign associations
• Neighborhood shows 0% abuse density
• Control plane indicates stable route with no MOAS status
• Single DNSBL listing warrants periodic review but does not indicate active abuse

Conclusion: 103.84.198.252 is a legitimate, low-risk endpoint from a regional ISP. No escalation or immediate mitigation actions required.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.