112.135.109.3📋 Copy

# IP Intelligence Briefing: 112.135.109.3/32

Classification: LOW RISK | Risk Score: 15 | Date: 2026-07-28

## Executive Summary

IP address 112.135.109.3/32 is classified as LOW RISK with a risk score of 15. The address shows no active threat indicators, no open services, and operates within a clean subnet with zero abuse density. Current profile indicates a firewalled host with no exposed services.

## Ownership and Infrastructure

• ASN: 9329 (Sri Lanka Telecom Internet)
• Organization: Asela Eranda
• Network Name: SLTADSL-SLT-LK
• CIDR Block: 112.135.109.0/24
• RIR: APNIC

## Geolocation Intelligence

Geolocation data shows conflicting sources:

• Primary Profile: Marseille, France (FR)
• Historical Signal: Colombo, Sri Lanka (LK)
• Consensus: False (geoConsensus: false)
• Assessment: Geographic discrepancies may indicate routing anomalies or multi-path traffic patterns.

## Threat Indicators

• Blacklist Count: 0 (profile) / 1 listing (medium severity, history)
• Tor Exit: False
• Known Attacker: False
• Spam Source: False
• Campaigns: None detected
• Threat Persistence: None observed

## Network Behavior

• Service Status: Firewalled / No Services (open_ports: [])
• DNS PTR: v4.dns.slt.lk
• Forward Resolution: Confirmed to slt.lk domain
• Email Auth: SPF and DMARC records present
• BGP Prefix: 112.135.96.0/19 (origin ASN 9329)

## Neighborhood Analysis

• Subnet: 112.135.109.0/24
• Abuse Density: 0% (clean)
• Threat Siblings: 0
• Active Siblings: 0
• Classification: Clean

## Observation History (18 Signals)

Recent observations include:

• Port scans detected on multiple attempts
• Geolocation signals varying between FR and LK
• ASN identification consistent (AS9329)
• One medium-severity blacklist listing observed
• No persistent malicious behavior detected

## Relationship Graph

• Same Network: SLTADSL-SLT-LK (multiple associations)
• DNS Associations: v4.dns.slt.lk (multiple associations)

## Security Actions

Recommendation: Monitor but no immediate blocking required. The low-risk classification and clean subnet profile support continued traffic. However, maintain awareness of geolocation discrepancies which may warrant further investigation if anomalous behavior is observed.

Firewall Rules: No specific rules generated.

## Intelligence Conclusion

This IP address represents a legitimate infrastructure endpoint within the Sri Lanka Telecom network. The low risk score, absence of active threats, and clean neighborhood profile indicate normal operational behavior. The geolocation discrepancy between France and Sri Lanka warrants periodic verification but does not currently indicate malicious activity. SOC teams should monitor for any changes in service exposure or threat indicator emergence.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.