112.135.216.38📋 Copy

# IP Intelligence Briefing: 112.135.216.38/32

Classification: Moderate Risk

Date Generated: 2026-07-29

---

## Executive Summary

IP address 112.135.216.38 is a Sri Lankan residential/fixed-line address assigned to SLTADSL (Sri Lanka Telecom) within ASN 9329. The IP carries a moderate risk score of 40/100 with no active threat indicators but shows DNSBL listing history (2 out of 8 lists, maximum severity: high). No active services are detected on this endpoint.

---

## Ownership and Network Context

Network Classification: Firewalled / No Services detected. The endpoint does not appear to host web services, DNS servers, or other public-facing infrastructure.

---

## Threat Assessment

Risk Score: 40/100 (Moderate)

Key Indicators:

• No known attacker reputation
• No spam source classification
• No active Tor/VPN/proxy associations
• Not a known campaign participant

DNSBL History:

• Listed on 2 of 8 total DNSBLs
• Maximum severity: high
• This indicates historical reputation concerns, though current threat indicators are absent

Control Plane Data:

• DNSSEC valid: Yes
• Route stability: False
• Route changes (30d): 0
• Origin ASN: 9329
• BGP Prefix: 112.135.192.0/19

---

## DNS Analysis

The DNS configuration shows proper SPF and DMARC implementation for the slt.lk domain, though forward resolution is not confirmed.

---

## Neighborhood Analysis

No neighboring IPs were discovered in the immediate /24 subnet. The subnet exhibits no elevated abuse density.

---

## Relationship Graph

The IP shows associations with:

• SLTADSL-SLT-LK (network segment - listed twice)
• v4.dns.slt.lk (DNS hostname - listed twice)

Total relationships: 4

---

## Historical Observations

Total Signals Observed: 18

Recent Activity:

• Geovalidation: ICMP blocked, unable to validate (minimum possible RTT: 165ms)
• Ownership stability: No changes detected
• Threat persistence: 0 days
• Not persistently malicious

---

## Recommended Security Actions

Based on the IP's risk profile, the following firewall rules are recommended:

---

## SOC Analyst Notes

• Block Recommendation: YES — Despite moderate risk classification and no active threats, the DNSBL listing history and moderate risk score warrant blocking on perimeter defenses.
• False Positive Risk: Low — SLTADSL is a legitimate Sri Lankan ISP; this appears to be a residential or fixed-line endpoint that may have been involved in past activity.
• Investigation Priority: LOW — No active threat indicators, no known campaigns, and isolated endpoint with no subnet neighbors showing abuse patterns.
• Monitoring: Consider adding to watchlist for re-evaluation if the IP begins showing active service signals or threat indicators.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.