110.172.147.190📋 Copy

# IP INTELLIGENCE BRIEFING: 110.172.147.190/32

Classification: HIGH RISK

Date: 2026-07-27

Intel Confidence: Medium-High

---

## EXECUTIVE SUMMARY

IP address 110.172.147.190 was assessed as HIGH RISK with an overall risk score of 80/100 during observation. The address belongs to IRT-WORLDPHONE-IN (ASN 18002) within the 110.172.147.0/24 CIDR block. Despite presenting as a firewalled infrastructure endpoint with no open services, the IP was detected against five of eight DNS blacklist feeds, indicating prior malicious activity or association with compromised endpoints.

---

## OWNERSHIP AND ATTRIBUTION

The IP originated from APNIC registry and is attributed to IRT-WORLDPHONE-IN. Network stability remained consistent with no ownership changes recorded during the observation period.

---

## GEOLOCATION DISCREPANCY

Geolocation signals presented conflicting data:

• Primary Signal: United States (Boston, MA, US-MA)
• Historical Signal: India (20.59°N, 78.96°E)
• Status: GeoConsensus: True (multiple sources)
• Validation: GeoPlausible: False

The geolocation data inconsistency warrants scrutiny. The IP may have been routed through multiple networks or exhibit characteristics of spoofing or misconfigured geolocation databases.

---

## THREAT INTELLIGENCE

Blacklist Status

• DNSBL Listings: 5 out of 8 total lists
• Maximum Severity: High
• Status: Active listings across multiple threat feeds

Threat Indicators

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Correlation: No matches detected
• Cert Matches: 0

While specific threat feed indicators were not populated, the elevated blacklist presence suggests the IP has been associated with malicious activity in the past.

---

## NETWORK BEHAVIOR ANALYSIS

Service Profile

• Open Ports: None detected
• TLS Certificate: None
• HTTP Title: None
• Classification: Firewalled / No Services

Behavioral Metrics

• Honeypot Hits: 0
• Enumeration Strikes: 0
• WAF Violations: 0
• Total Incidents: 0

The IP presents as a static, non-service endpoint. No active scanning, enumeration, or web-based malicious activity was observed during the assessment window.

---

## SUBNET CONTEXT

Subnet: 110.172.147.190/24

Abuse Density: 0

Classification: Clean

Active Siblings: 0

Threat Siblings: 0

The immediate /24 subnet showed no adjacent threat activity, indicating the risk is localized to this specific endpoint rather than representing broader network compromise.

---

## OBSERVATION HISTORY

Twelve signals were recorded during the observation period. Key observations included:

• ASN and RIR confirmation from APNIC registry
• DNSSEC validation confirmed
• Multiple blacklist detections with high severity ratings
• Geolocation signals showing both US and Indian coordinates

The temporal data indicates the IP has been persistently monitored with consistent risk scoring.

---

## RECOMMENDED ACTIONS

Based on the 80/100 risk score and blacklist presence, the following defensive measures are recommended:

Immediate Actions

1. Block Traffic: Implement firewall rules to drop all traffic from 110.172.147.190

2. Increase Logging: Enable enhanced logging verbosity for any attempted connections

3. Monitor for Recurrence: Track whether additional IPs from the 110.172.147.0/24 subnet exhibit similar behavior

Technical Implementation

iptables:

```bash

iptables -A INPUT -s 110.172.147.190 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 110.172.147.190 drop

```

nginx:

```nginx

deny 110.172.147.190;

```

AWS WAF:

```json

{

"Addresses": ["110.172.147.190/32"],

"Description": "IPDebrief risk 80"

}

```

---

## ANALYST NOTES

The IP address presents a moderate-to-high risk profile characterized by blacklist presence and geolocation inconsistency. While the endpoint itself shows no active service exploitation, the blacklist associations suggest prior compromise or malicious association. The lack of adjacent subnet activity suggests this is an isolated threat vector. Continuous monitoring is recommended to detect any changes in behavior or the emergence of related malicious infrastructure.

Intelligence Product: IPDebrief

Copyright: © 2026 Jason Alberino. All rights reserved.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.