110.39.181.194📋 Copy

## IP Intelligence Briefing: 110.39.181.194/32

Executive Summary

IP address 110.39.181.194 is classified as High Risk with a risk score of 80/100. The address originates from ASN 38264 (WATEEN-IMS-PK-AS-AP) within the Pakistan National WiMAX/IMS network infrastructure. The IP shows signs of abuse through multiple DNSBL listings and demonstrates firewalling characteristics with no active services detected.

---

Current Profile

Risk Indicators:

• Risk Score: 80/100 (High Risk)
• Reputation: High Risk
• DNSBL Listings: 5 out of 8 total lists
• Listed Status: Active on multiple threat feeds

Geolocation & Network Origin:

• ASN: 38264 (WATEEN-IMS-PK-AS-AP)
• Network Prefix: 110.39.180.0/22
• Geographic Location: Marseille, FR (geographic consensus flagged as inconsistent)
• ASN Registration: Pakistan (APNIC), allocated 2009-02-24

DNS & Infrastructure:

• PTR Hostname: WGPON-39181-194.wateen.net
• Domain: wateen.net
• DNSSEC: Valid
• Email Authentication: No SPF or DMARC records configured
• Service Status: Firewalled / No Services detected

Control Plane:

• Route Stability: 0 route changes in 30 days (not stable)
• RPKI State: Not validated
• Transit Networks: Comcast

---

Observation History Analysis

The IP has generated 15 historical observations with the following patterns:

• Latest Activity (2026-07-18): Multiple DNS-related signals detected with confidence levels ranging from 0.50 to 0.90
• DNS Listings: Active presence on 8 total blacklist sources with 5 high-severity listings
• ASN Confirmation: Consistent association with ASN 38264 across observations
• DNSSEC Validation: Valid DNSSEC records maintained throughout observation period

The temporal analysis indicates limited threat persistence with 0 threat observation days recorded and no persistent malicious behavior flags.

---

Relationship Graph

Limited relationship connectivity detected:

• DNS Association: Single hostname linkage to WGPON-39181-194.wateen.net
• No Related Entities: No additional subnets, organizations, or certificate associations identified
• Campaign Correlation: 0 correlated IPs, 0 certificate matches

---

Neighborhood Analysis

Subnet: 110.39.181.194/24

• Neighbor Count: 0
• Abuse Density: 0
• Risk Distribution: No high/medium/low risk siblings detected
• Classification: Insufficient data for subnet-level classification

The isolated nature of this address within its /24 subnet suggests either a single-host configuration or limited neighbor discovery.

---

Recommended Actions

Immediate Mitigation:

1. Firewall Blocking - Recommended:

```

iptables -A INPUT -s 110.39.181.194 -j DROP

nft add rule inet filter input ip saddr 110.39.181.194 drop

```

2. WAF Configuration - Block at application layer:

- Cloudflare WAF: Block with expression `ip.src eq 110.39.181.194`

- AWS WAF: Add to deny list with CIDR `110.39.181.194/32`

3. Monitoring Enhancement - Critical Severity:

- Increase logging verbosity for this source IP

- Review recent activity logs for correlation with known campaigns

Justification: Risk score of 80/100 with active DNSBL listings warrants immediate defensive action. The absence of open ports suggests the IP may be used for scanning or other reconnaissance activities rather than hosting services.

---

Intelligence Notes

• The geographic inconsistency (FR vs PK) suggests potential proxying or misreporting
• Limited relationship graph indicates this IP operates in isolation or has minimal network connections
• Multiple DNSBL listings despite no active services detected indicates prior abuse history or reputation contamination
• Route stability metrics (0 changes in 30 days) suggest relatively static network infrastructure

Classification: High Risk - Immediate defensive action recommended.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.