112.134.128.120📋 Copy

# IP Intelligence Briefing: 112.134.128.120

## Executive Summary

IP 112.134.128.120 is assigned to Sri Lanka Telecom (SLT) infrastructure with a moderate risk score of 40/100. The endpoint is firewalled with no open services and operates within the 112.134.128.0/24 CIDR block. Historical data indicates stable ownership with no persistent malicious activity patterns. Current threat indicators are absent, and neighborhood abuse density registers at zero.

## Ownership and Geolocation

• ASN: 9329 (Asela Eranda)
• Organization: SLTADSL-SLT-LK
• CIDR Block: 112.134.128.0/24
• Country: Sri Lanka (LK)
• Region: Western Province
• City: Kandana
• Registration: APNIC RIR

## Network Classification and Services

• Infrastructure Type: Residential/Corporate Access
• Open Ports: None detected
• Service Status: Firewalled / No Services
• DNS PTR Hostname: v4.dns.slt.lk
• Email Authentication: SPF and DMARC records present

## Threat Indicators

• Risk Score: 40 (Moderate)
• Blacklist Status: Listed on 2 of 8 DNSBL feeds
• Threat Feeds: No active indicators
• Known Campaigns: None
• Tor Exit Node: No
• Spam Source: No
• Known Attacker: No

## Control Plane Analysis

• Route Stability: False (route changes observed in 30-day window)
• RPKI State: Not verified
• IRR Consistency: Not evaluated
• DNSSEC: Valid
• Operator Score: 0.1304 (Minimal)

## Historical Observations

Thirteen signal observations recorded across July 27, 2026. Geolocation data remains consistent (Kandana, Western Province, LK). Operator scores maintained at minimal levels (0.15). DNSBL listings show persistent presence on 2 of 8 blacklist feeds with high severity ratings. No threat persistence days recorded.

## Relationship Mapping

• Network Association: SLTADSL-SLT-LK
• DNS Associations: v4.dns.slt.lk
• Total Relationships: 4 entities

## Neighborhood Analysis (112.134.128.0/24)

• Subnet Abuse Density: 0%
• Total Siblings: 0
• Active Threat Siblings: 0
• High-Risk Neighbors: 0

## Recommended Actions

The moderate risk classification is primarily driven by DNSBL listings rather than active threat indicators. Given the absence of open services, no known malicious campaigns, and zero neighborhood abuse density, this IP represents low operational risk.

SOC Recommendations:

1. Allow with Monitoring: No immediate blocking required. Standard traffic monitoring advised.

2. DNSBL Review: Investigate the two blacklist listings to determine if they relate to historical reputation issues or current activity.

3. Route Stability Watch: Monitor for route changes affecting SLTADSL-SLT-LK network.

4. Baseline Comparison: Compare against other SLT infrastructure IPs to establish baseline behavior.

## Risk Assessment

Overall Risk: Low-Moderate

Action Required: Routine monitoring only

Confidence Level: High (13 historical observations, consistent geolocation, no conflicting data)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.