116.66.190.226📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 116.66.190.226/32

Date: 2026-07-28

Classification: Moderate Risk

---

## EXECUTIVE SUMMARY

IP 116.66.190.226 is a web server infrastructure asset located in Bengaluru, Karnataka, India. The address operates under ASN 135724 (IRT-PVTABNL-IN) within the PVTABNL CIDR block (116.66.188.0/22). Current risk assessment indicates moderate risk (score: 50) driven by two DNSBL listings, though no active threat indicators or malicious activity have been observed. The IP shows no evidence of being used as a proxy, Tor exit node, or spam source.

---

## TECHNICAL PROFILE

DNS Analysis

• PTR Hostnames: None resolved
• Forward Resolution: 0 records
• Email Authentication: No SPF/DMARC records
• DNSBL Listings: 2 of 8 total lists

---

## THREAT ASSESSMENT

Risk Indicators

• Overall Risk Score: 50 (Moderate)
• Abuse Confidence: Not classified
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Cloud/Vpn/Proxy: No

Threat Feed Correlation

• Blacklist Count: 0 (despite 2 DNSBL listings)
• Known Campaigns: None detected
• Threat Feeds: Empty
• Campaign Likelihood: None

Control Plane

• BGP Prefix: 116.66.190.0/24
• Route Stability: False
• RPKI State: Not available
• DNSSEC: Valid

---

## HISTORICAL ANALYSIS

Fourteen signal observations recorded since last update. Key observations:

1. 2026-07-28 02:55 UTC – Geo validation confirmed with 90% confidence (claimed coordinates: 12.9753°N, 77.591°E)

2. 2026-07-28 02:54 UTC – Organization and ASN data validated via RIR database

3. 2026-07-28 02:53 UTC – HTTPS connection failed during probe

4. 2026-07-28 02:52 UTC – No banner matches or certificate correlations detected

No evidence of persistent malicious activity or ownership changes detected.

---

## NETWORK CONTEXT

Neighborhood Analysis

• Subnet: 116.66.190.0/24
• Abuse Density: 0 (no neighboring abuse activity)
• Sibling IPs: 0 active siblings with risk data
• Classification: Isolated address within subnet

Relationships

• Network Association: PVTABNL (Same Network)
• Related Entities: 1 identified relationship

---

## SOC ACTIONS & RECOMMENDATIONS

Monitoring Priority

MEDIUM – Continue monitoring for changes in risk profile or new threat indicators.

Firewall Rules

No immediate blocking recommended. Standard web traffic inspection applies.

Investigation Triggers

Escalate if any of the following occur:

• New threat indicators appear in threat feeds
• DNSBL listing count increases significantly
• Evidence of port scanning or lateral movement
• Change in geolocation or network ownership

Intelligence Notes

The moderate risk score appears to be model-driven rather than threat-driven. The two DNSBL listings may result from historical activity or false positives. No active malicious behavior has been observed in the historical record. The IP maintains a stable web server footprint with Apache service.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.