103.98.129.98📋 Copy

## IP Intelligence Briefing: 103.98.129.98

Classification: Moderate Risk | Risk Score: 55/100 | Date of Analysis: 2026-07-29

Executive Summary

IP address 103.98.129.98 belongs to IRT-ETPL-NP within the 103.98.129.0/24 CIDR block. The IP maintains a moderate risk profile with no active services detected and a firewalled network role. Geographic data shows conflicting indicators between US (Newark, NJ) and NP (Nepal) in historical signals. The subnet exhibits low abuse density with three low-risk sibling IPs.

Technical Profile

• Organization: IRT-ETPL-NP
• ASN: 58504
• CIDR Block: 103.98.129.0/24
• RIR: APNIC
• Network Role: Firewalled / No Services
• Open Ports: None detected
• DNS Records: No PTR records; no forward resolution

Threat Indicators

• Blacklist Status: 0 major threat feed listings; 3 DNSBL listings out of 8 total
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Abuse Confidence Score: Not available
• Threat Persistence: Not persistently malicious

Geographic Discrepancies

Historical signals indicate conflicting geolocation data:

• Current profile: United States (Newark, NJ)
• Historical geolocation: Nepal (NP)

This discrepancy warrants monitoring and correlation with additional intelligence sources.

Neighborhood Analysis

The /24 subnet contains four sibling IPs with the following risk distribution:

• High risk: 0
• Medium risk: 0
• Low risk: 3

Siblings include:

• 103.98.129.76 (Risk: 25)
• 103.98.129.160 (Risk: null)
• 103.98.129.214 (Risk: 0)
• 103.98.129.220 (Risk: 0)

Subnet abuse density: 0

Historical Signals

Analysis of 10 recent observations reveals:

• Organization and ASN data consistently attributed to APNIC
• DNSBL listings detected with max severity rating of high
• Operator score: 0.1304 (Minimal)
• Data confidence: 0.0833 (low data sufficiency)
• Route stability: False (routing changes observed)

Recommended Actions

Monitoring:

• Increase logging verbosity for traffic from this IP
• Review recent activity patterns and correlate with threat intelligence feeds

Firewall Rules:

• iptables: `iptables -A INPUT -s 103.98.129.98 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 103.98.129.98 drop`
• nginx: `deny 103.98.129.98;`
• Cloudflare WAF: Block IP with expression `ip.src eq 103.98.129.98`
• AWS WAF: Block IP 103.98.129.98/32

Intelligence Notes

The IP's moderate risk score combined with geographic inconsistencies and DNSBL listings suggests potential misconfiguration or abuse activity. The firewalled status with no open services indicates either defensive hardening or active blocking. Correlation with the three low-risk sibling IPs in the same subnet suggests limited subnet-wide threat activity.

Priority: Monitor | Status: Active Surveillance Recommended

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.