112.134.130.205📋 Copy

## IP Intelligence Briefing: 112.134.130.205

Classification: Moderate Risk | Report Date: 2026-07-22

Target: 112.134.130.205/32

Jurisdiction: Sri Lanka (LK) | Region: Western Province, Kandana

ASN: 9329 | Organization: Asela Eranda (SLTADSL-SLT-LK)

---

Executive Summary

The target IP 112.134.130.205 is a Sri Lankan residential/enterprise connection under Sri Lanka Telecom (SLT) infrastructure. The IP carries a moderate risk score (55/100) and is currently firewalled with no active services exposed. While blacklisted on 3 of 8 DNSBL entries, the IP shows no persistent malicious behavior and zero active threat indicators. The broader /24 subnet maintains a clean classification with zero abuse density.

---

Technical Profile

Network Attribution:

• ASN: 9329 (Asela Eranda)
• CIDR Block: 112.134.130.0/24
• RIR: APNIC
• Contact: abuse@slt.lk (via RDAP)

Geolocation:

• Country: Sri Lanka (LK)
• City: Kandana / Colombo-1
• Coordinates: 7.05°N, 79.89°E
• Geo Consensus: Validated across 1 source

Service Status:

• Open Ports: None detected
• HTTP/HTTPS: No active services (Firewalled / No Services)
• TLS Certificate: None
• DNS Resolution: v4.dns.slt.lk (SLT infrastructure)
• PTR Records: v4.dns.slt.lk
• Email Authentication: SPF and DMARC records present for SLT domain

Threat Indicators:

• Blacklist Count: 3 of 8 DNSBL lists
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Campaigns: None detected
• Threat Persistence: Zero days observed

---

Historical Analysis

Observation Timeline: 16 signals recorded

• Recent Activity: Last observed 2026-07-22T04:54:33 UTC
• Ownership Stability: No ownership changes detected (stabilityScore: 0)
• Threat Persistence: 0 days (not persistently malicious)
• Signal Evolution: Historical data shows consistent network classification with no escalation in threat posture. All recent signals (confidence 0.30–0.95) confirm residential/enterprise connection type.

Key Observations:

• Ownership attribution stable to Asela Eranda
• Geographic location consistently mapped to Sri Lanka
• No transitions to CDN, cloud, proxy, or hosting infrastructure

---

Relationship Mapping

Direct Associations (5 total):

1. Network: SLTADSL-SLT-LK (Same Network – 2 entries)

2. Hostname: v4.dns.slt.lk (DNS Association – 3 entries)

Subnet Analysis (112.134.130.0/24):

• Abuse Density: 0 (Clean)
• Active Siblings: 0
• Threat Siblings: 0
• Total Siblings: 1
• Classification: Clean

No neighboring IPs in the /24 subnet show elevated risk, indicating isolated activity rather than coordinated abuse.

---

Risk Assessment

Primary Risk Factors:

• DNSBL listings (3/8) suggest prior reputation issues
• Moderate risk score (55/130) without specific threat correlation
• Historical blacklisting without current malicious activity

Mitigating Factors:

• Zero open services or active ports
• No known attacker or spam source designation
• Clean subnet-level context
• Stable ownership with no recent changes
• No campaign or correlated IP activity

Overall Risk: MODERATE

The IP represents a legitimate SLT infrastructure endpoint with historical reputation concerns but no active threat profile.

---

Recommended Actions

Defense Posture: Monitor (No Immediate Action Required)

• The IP does not meet criteria for aggressive blocking
• Existing DNSBL listings may warrant continued monitoring but not immediate takedown
• No firewall rules required beyond standard perimeter controls

SOC Guidance:

1. Traffic Allowance: Permitted if originating from expected SLT ranges

2. Logging: Log connection attempts for correlation analysis

3. Escalation Threshold: Escalate only if activity exhibits malicious payloads, brute force patterns, or unusual port scanning

No specific firewall rules, WAF policies, or blocking actions required at this time.

---

Conclusion

IP 112.134.130.205 is a Sri Lankan SLT endpoint with moderate historical risk but no current malicious activity. The subnet remains clean with no neighborhood threat indicators. SOC teams may allow traffic while maintaining standard monitoring protocols. No immediate threat mitigation actions are warranted based on available intelligence.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.