103.99.38.222📋 Copy

# IP INTELLIGENCE BRIEFING: 103.99.38.222/32

Date: 2026-07-30

Analyst: IPDebrief Intelligence Division

Classification: Standard Threat Intelligence

---

## EXECUTIVE SUMMARY

Target IP 103.99.38.222 is classified as LOW RISK with a risk score of 0/100. The address belongs to a commercial web hosting infrastructure operated by MOORTHY BADDI (ASN 151734) in Noida, Uttar Pradesh, India. No active threat indicators or malicious activity were observed.

---

## OWNERSHIP AND GEOLOCATION

Geolocation validation confirms the IP's claimed location with 5 probe samples, showing consistent RTT measurements (243-250ms) and distance verification (6,251.5km from probe origin).

---

## NETWORK INFRASTRUCTURE

Service Role: Web Server

Open Ports:

• Port 80/TCP (HTTP)
• Port 443/TCP (HTTPS)
• Port 22/TCP (SSH - OpenSSH_9.6p1 Ubuntu-3ubuntu13.18)

Reverse Proxy Detection: TLS certificate analysis confirms CloudFlare Origin SSL infrastructure, indicating this IP may be a backend origin server protected by CloudFlare's CDN/waf services.

Server Fingerprint: nginx/1.31.3

---

## THREAT ASSESSMENT

Current Risk Profile:

• Risk Score: 0
• Abuse Confidence Score: N/A
• Blacklist Count: 0
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

Threat Indicators: No threat indicators detected across all scanned threat feeds.

---

## DNS AND EMAIL AUTHENTICATION

Assessment: The absence of SPF and DMARC records suggests this is a backend infrastructure IP rather than a public-facing email server. DNSSEC validation confirms proper DNS security configuration.

---

## NEIGHBORHOOD ANALYSIS

Subnet: 103.99.38.0/24

Total Siblings: 10

Abuse Density: 0%

Risk Distribution in Subnet:

• High Risk: 0
• Medium Risk: 1 (103.99.38.236, Risk Score: 40)
• Low Risk: 9

Notable Neighbors:

• 103.99.38.236 (Risk Score: 40) - Elevated risk within subnet
• 103.99.38.128, 103.99.38.131, 103.99.38.142, 103.99.38.145, 103.99.38.154, 103.99.38.212, 103.99.38.235 (Risk Score: 25)
• 103.99.38.105, 103.99.38.156 (Risk Score: 0)

Assessment: The target IP shows no elevated risk relative to its subnet. One neighbor (103.99.38.236) demonstrates higher risk activity.

---

## OBSERVATION HISTORY

Total Observations: 15 signals

Recent Activity: No ownership changes, no threat persistence detected

Key Observations (Last 24 Hours):

• 2026-07-30 14:02: Ownership signal (Confidence: 85%)
• 2026-07-30 14:01: Geolocation probe (Confidence: 90%)
• 2026-07-30 14:00: HTTP fingerprint (Confidence: 80%) - Status 200, nginx/1.31.3
• 2026-07-30 13:58: Network classification (Confidence: 30%)
• 2026-07-30 13:58: Geolocation inference (Confidence: 52%)

Temporal Analysis:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 0
• Persistently Malicious: No

---

## CONTROL PLANE ANALYSIS

---

## SECURITY RECOMMENDATIONS

Action Required: None

Recommendations: Empty (no immediate action required)

The target IP presents no actionable threats. Standard monitoring procedures are sufficient. No firewall rules or blocking actions are recommended based on current intelligence.

---

## RELATIONSHIP GRAPH

Connected Entities: 4 relationships identified

• All relationships classified as "Same Network" pointing to network entity "YOTTA"
• No relationships to hostnames, organizations, or certificates outside the network

---

## CONCLUSION

IP 103.99.38.222 is a low-risk commercial web server infrastructure component. The absence of threat indicators, combined with CloudFlare origin certificate evidence, suggests

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.