103.85.9.17📋 Copy

# INTELLIGENCE BRIEFING: IP 103.85.9.17/32

## Executive Summary

IP 103.85.9.17 is a low-risk, residential endpoint located in Ahmedabad, Gujarat, India. The address operates under the VAJI network and is currently firewalled with no active services detected. While current threat scoring indicates minimal risk, historical data reveals recent blacklist activity requiring monitoring.

## Technical Profile

• IP Address: 103.85.9.17/32
• Location: Ahmedabad, Gujarat, India (23.03°N, 72.59°E)
• ASN: 45916 (GTPL-AS-AP - Gujarat Telelink Pvt Ltd)
• Network: 103.85.8.0/22
• Organization: Manager admin / VAJI
• RIR: APNIC (allocated 2017-02-03)
• Current Status: Firewalled / No Services

## Risk Assessment

## Threat Indicators

• No active threat indicators detected
• Not classified as Tor exit, known attacker, or spam source
• No associated malware campaigns
• DNSSEC validation present on reverse DNS zone

## Network Behavior

• Services: None detected (firewalled)
• DNS: No PTR records; no forward resolution
• Email: No SPF or DMARC records
• Open Ports: None
• TLS/Certificates: None detected

## Historical Signals

10 observations recorded with recent activity including:

• July 30, 2026: Listed on 8 threat intelligence sources with high severity ratings
• ASN Resolved: GTPL-AS-AP, IN (Gujarat Telelink)
• DNSSEC: Valid reverse DNS zone
• No persistent malicious activity observed

## Network Neighborhood

Subnet 103.85.9.0/24 shows:

• Abuse Density: 0
• Total Siblings: 2 detected
• Active Neighbor: 103.85.9.95 (Risk: 25, Authority: 50)
• Risk Distribution: 1 low-risk, 0 medium-risk, 0 high-risk

## Relationship Graph

Two relationships identified:

• Same Network: VAJI (x2 entries)

## SOC Recommendations

Current Action: Monitor

• No immediate blocking recommended (risk score = 0)
• Monitor neighbor 103.85.9.95 which shows elevated risk indicators
• Track blacklist history for potential correlation with recent high-severity listings

Priority: LOW

The IP presents minimal immediate threat but warrants passive observation given recent blacklist activity in historical signals.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.