103.91.211.13📋 Copy

# IP INTELLIGENCE BRIEFING

Target IP: 103.91.211.13/32

Date: Current

Classification: Low Risk / Monitoring Recommended

---

## EXECUTIVE SUMMARY

IP 103.91.211.13 is a low-risk infrastructure address operating within the Yuan Yin (SDYXT) network block in China. The address shows no active malicious indicators, no open services, and zero threat persistence. However, the IP is associated with one DNSBL listing and exhibits route instability, warranting continued monitoring.

---

## OWNERSHIP & GEOLOCATION

• ASN: 139180 (Yuan Yin)
• Organization: Yuan yin (SDYXT)
• Network Block: 103.91.208.0/22
• RIR: APNIC
• Country: China (CN)
• Abuse Contact: 18663266565@163.com

The IP is registered under APNIC RIR and belongs to the SDYXT network block. Geolocation data indicates China with 52% confidence, though geo-validity flags show plausible location is false.

---

## THREAT ASSESSMENT

• Risk Score: 25 (Low Risk)
• Abuse Confidence: Not applicable
• Blacklist Status: 1 DNSBL listing detected (out of 8 total lists checked)
• Malicious Indicators: None

- Not a Tor exit node

- Not a known attacker

- Not a spam source

- No active threat campaigns

• Operator Score: 0.1304 (Minimal threat level)
• Persistently Malicious: No

---

## NETWORK BEHAVIOR

• Services: No open ports detected; service purpose classified as "Firewalled / No Services"
• DNS: No PTR hostnames; forward resolution not confirmed; zero hosted domains
• Email: No SPF or DMARC records present
• HTTP: No TLS certificate; no HTTP title; no server banners
• Traceroute: 30 hops with 29 timed out, indicating aggressive filtering or non-standard routing path

---

## NEIGHBORHOOD ANALYSIS

• Subnet: 103.91.211.13/24
• Neighbor Count: 0 (isolated address in /24)
• Abuse Density: 0%
• Risk Distribution: No high-risk neighbors
• Threat Siblings: 0

The IP shows no association with neighboring threat actors within its subnet.

---

## HISTORICAL OBSERVATIONS

• Total Signals: 12 observations
• Ownership Changes: 0
• Threat Persistence Days: 0
• Recent Activity: Signals observed as of 2026-07-29
• Campaign Correlation: 0 correlated IPs
• Certificate Matches: 0

The address demonstrates stable ownership with no historical threat persistence indicators.

---

## RELATIONSHIP GRAPH

• Same Network Entities: 3 (all SDYXT)
• External Relationships: None detected (no hostnames, organizations, or certificates)

---

## SECURITY ACTIONS & RECOMMENDATIONS

Immediate Actions

1. Allow Traffic: Low risk profile supports standard allow rules

2. Monitor DNSBL: Investigate the single DNSBL listing if traffic originates from this IP

3. Verify Route Stability: The unstable route status (isRouteStable: false) warrants periodic re-validation

Firewall Rules (iptables/nftables)

```bash

# Standard allow for low-risk IP

iptables -A INPUT -s 103.91.211.13 -j ACCEPT

# Optional: Log first-time connections for audit

iptables -A INPUT -s 103.91.211.13 -j LOG --log-prefix "IP-103.91.211.13-LOG "

```

WAF Rules (Cloudflare/AWS)

No blocking rules recommended. Monitor for policy violations.

---

## INTELLIGENCE JUDGMENT

Risk Level: LOW

Threat Actor Status: None Identified

Recommended Action: Continue routine monitoring. No immediate blocking required.

The IP address represents legitimate infrastructure with no malicious indicators detected. The single DNSBL listing and route instability are minor concerns that do not warrant immediate action but should be noted for future reference.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.