103.84.5.172📋 Copy

# IPDebrief Intelligence Briefing: 103.84.5.172/32

## Executive Summary

IP address 103.84.5.172 is classified as Moderate Risk with an overall risk score of 50. The IP operates within the 103.84.5.0/24 subnet (ASN 132641) and is currently firewalled with no active services detected. Geographic data shows conflicting indicators between GB and ID regions, requiring further validation.

## Threat Assessment

Risk Score: 50/100 (Moderate Risk)

Reputation: Moderate Risk

Threat Classification: None identified (not Tor exit, not known attacker, not spam source)

Blacklist Status: Listed on 2 of 8 DNSBL feeds

Control Plane: Route stability flagged as false; 30-hop traceroute with 20 timed-out hops

## Network Profile

• ASN: 132641
• BGP Prefix: 103.84.5.0/24
• Geolocation: Conflicting data — profile indicates GB (London), but observation history shows ID (Panunggangan Timur, Tangerang)
• Organization: Ali Wibowo (APNIC RIR)
• Service Status: Firewalled / No Services
• Open Ports: None detected

## Neighborhood Analysis (103.84.5.0/24)

• Abuse Density: 0
• Total Siblings: 2
• Risk Distribution:

- 103.84.5.9: Risk Score 65 (Medium Risk)

- 103.84.5.46: Risk Score 25 (Low Risk)

• Net Classification: No inherited threat indicators

## Relationship Graph

No related entities detected in relationship database (0 relationships).

## Historical Observations

12 observation records captured. Recent activity from 2026-07-28 shows:

• Geolocation signals varying between GB and ID regions
• Organization data consistently points to Ali Wibowo/NETCITI-ID
• Multiple port scan attempts detected
• Operator score: 0.1304 (Minimal)
• No persistent malicious behavior observed

## Recommended Security Actions

Based on risk profile, the following defensive measures are recommended:

## Intelligence Narrative

The target IP 103.84.5.172 presents moderate risk characteristics. While no active services or open ports are detected, the IP is listed on multiple DNSBL feeds and shows route instability. Geographic inconsistencies between GB and ID indicators suggest potential data quality issues or multi-region operations. The neighboring IP 103.84.5.9 carries elevated risk (score 65) and warrants monitoring within the same /24 subnet. No evidence of active campaigns, Tor usage, or known malicious activity was found. The moderate risk classification and DNSBL listings warrant defensive blocking, particularly for critical infrastructure.

## Analyst Notes

• Verify geolocation discrepancy (GB vs ID) before final risk assessment
• Monitor neighbor 103.84.5.9 for coordinated activity
• Consider subnet-level filtering if 103.84.5.0/24 shows increased threat activity
• Re-assess if threat indicators emerge in future observations

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.