103.97.208.10📋 Copy

IP INTELLIGENCE BRIEFING: 103.97.208.10

Classification: MODERATE RISK

Date of Analysis: 2026-07-30

Analysis Tool: IPDebrief Intelligence Platform

---

EXECUTIVE SUMMARY

IP address 103.97.208.10 is associated with IDC Legend Corp administrator (ASN 10010) in Japan. The IP presents moderate risk (score: 40) with no active threat indicators but exhibits two DNSBL listings across eight total lists. The subnet demonstrates clean classification with zero abuse density. SOC teams may consider blocking based on organizational policy thresholds.

---

OWNERSHIP AND GEOLOCATION

• Organization: IDC Legend Corp administrator
• Network Name: IDCLEGEND-JP
• CIDR Block: 103.97.208.0/23
• ASN: 10010 (APNIC RIR)
• Country: Japan (JP)
• Geolocation Accuracy: 600km radius, consensus validated

---

THREAT ASSESSMENT

Current Risk Profile:

• Overall Risk Score: 40 (Moderate)
• Threat Indicators: None detected
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Blacklist Count: 0 direct listings

Control Plane Indicators:

• Route Stability: Unstable (isRouteStable: false)
• DNSBL Listings: 2 of 8 total lists
• Operator Score: 0.1304 (Minimal)
• DNSSEC: Valid

---

NETWORK BEHAVIOR

Service Exposure:

• Open Ports: None detected
• Service Purpose: Firewalled / No Services
• TLS Certificates: None
• HTTP Banner: None

Network Role Classification:

• Not identified as CDN, cloud, VPN, proxy, Tor, hosting, mobile, residential, or anycast

Historical Observations (15 total):

• Recent subnet classification: Clean
• Abuse density: 0
• Ownership changes: 0
• Threat observation count: 0
• Threat persistence: Not observed
• Port scanning activity detected but no services resolved

---

NEIGHBORHOOD ANALYSIS

Subnet: 103.97.208.0/24

• Total Siblings: 1
• Active Siblings: 1
• Threat Siblings: 0
• Abuse Density: 0
• Classification: Clean

No neighboring IPs in the /24 demonstrate malicious activity.

---

RELATIONSHIP GRAPH

All identified relationships point to the IDCLEGEND-JP network. No external hostnames, organizations, or certificates were associated with this IP.

---

RECOMMENDED ACTIONS

Firewall Rule Implementation:

• iptables: `iptables -A INPUT -s 103.97.208.10 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 103.97.208.10 drop`
• nginx: `deny 103.97.208.10;`
• pfSense: Block 103.97.208.10/32
• Cloudflare WAF: Block with expression `ip.src eq 103.97.208.10`
• AWS WAF: Add 103.97.208.10/32 to IP set

Rationale: The IP presents moderate risk with DNSBL listings. While no active threat indicators were observed, the unstable routing status and moderate risk score warrant defensive blocking.

---

MONITORING RECOMMENDATIONS

• Monitor for any emergence of open ports or service banners
• Watch for new threat indicators or blacklist additions
• Track subnet-level activity across 103.97.208.0/24
• Verify route stability improvements over time

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.