103.93.105.147📋 Copy

# IP Intelligence Briefing: 103.93.105.147

Classification: Low Risk / Monitoring Required

Date of Analysis: 2026-07-23

Analyst: SOC Intelligence Division

---

## Executive Summary

IP address 103.93.105.147 is classified as Low Risk (Risk Score: 25/100) with a clean network reputation. The IP belongs to the Manager NOC organization (ASN 58898) under the SANGAKPM network, located in India (APNIC RIR). The address shows minimal threat indicators, no active services, and no persistent malicious behavior observed across the monitoring period.

---

## Network Profile

---

## Threat Indicators

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Proxy/VPN: No
• Hosting Provider: No
• Blacklist Status: Listed on 1 of 8 DNSBL feeds (max severity: high)
• Open Ports: None detected
• TLS/HTTP Services: No active services observed
• Threat Persistence: 0 days (not persistently malicious)

---

## Neighborhood Analysis (103.93.105.0/24)

• Total Subnet IPs: 10
• Abuse Density: 0% (clean classification)
• Active Siblings: 0
• Threat Siblings: 0
• Risk Distribution: 1 medium-risk IP detected

Notable Neighbor: 103.93.105.149 shows elevated risk (Score: 40, Authority: 50) requiring separate monitoring.

---

## Observation History

Sixteen signals recorded since last observation. Key timeline:

• 2026-07-23T09:53: Network classification confirmed as non-CDN, non-Tor, non-VPN
• 2026-07-23T09:50: Subnet abuse density classified as clean (0% risk)
• 2026-07-23T09:49: DNS resolution to server.rainbowisp.in confirmed; DNSBL listing activity detected
• 2026-07-23T09:48: Geolocation inference from India (multi-signal consensus)

The IP demonstrates temporal stability with no significant ownership changes or threat escalation patterns.

---

## Relationship Mapping

• Network Affiliation: Multiple associations with SANGAKPM network (103.93.104.0/22)
• DNS Associations: server.rainbowisp.in (3 relationship links)
• Organizational Links: None beyond network-level associations

---

## Recommended Actions

Immediate: Monitor for service activation and DNSBL listing changes.

Firewall Rules: No immediate blocking recommended; IP classified as Low Risk.

Ongoing Monitoring:

• Track the single DNSBL listing on the 8 listed feeds
• Monitor neighboring IP 103.93.105.149 (medium-risk, score 40)
• Alert on any new open ports or service banners

---

## Risk Assessment Summary

This IP address presents minimal threat to organizational infrastructure. The low risk score, absence of active services, and clean neighborhood classification support continued monitoring rather than blocking. The single DNSBL listing warrants observation but does not currently indicate active malicious behavior.

SOC Recommendation: Allow traffic with enhanced monitoring for the next 30 days.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.