119.15.155.114📋 Copy

INTELLIGENCE BRIEFING: 119.15.155.114

Classification: Moderate Risk | Data Confidence: 0.125

Overview

IP 119.15.155.114 presents a moderate risk profile (score: 50/100). The address is registered within BGP prefix 119.15.155.0/24 under ASN 133954 (EXORDONLINE-BD - Exord Online, BD), originating from Bangladesh (BD). The IP maintains minimal operator activity (operator score: 0.1304) and no persistent threat indicators.

Network Characteristics

• ASN: 133954 (EXORDONLINE-BD)
• Geolocation: Bangladesh (BD)
• Services: Firewalled / No active services detected
• DNS Resolution: No forward resolution; PTR records absent
• DNSSEC: Valid
• Route Stability: Not route stable

Threat Indicators

• DNSBL Status: Listed on 2 of 8 threat feeds (dnsblListedCount: 2)
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Association: None detected

Observation History

Six signal observations recorded. Recent activity (2026-07-31) shows:

• DNSBL listings with high severity severity classification
• ASN routing information from Team Cymru DNS
• DNSSEC validation confirmed
• Operator score: 0.1304 (Minimal)

Subnet Analysis

The /24 subnet (119.15.155.0/24) exhibits low abuse density (0). Three neighboring IPs were discovered, all classified as low risk with risk scores of 25. No high-risk siblings detected within the immediate neighborhood.

Relationship Graph

No relationships detected (zero connections to organizations, hostnames, or certificates).

Recommended Actions

Block traffic from this IP address using the following rules:

• iptables: `iptables -A INPUT -s 119.15.155.114 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 119.15.155.114 drop`
• nginx: `deny 119.15.155.114;`
• pfSense: `119.15.155.114/32`
• Cloudflare WAF: Block IP 119.15.155.114 with expression `ip.src eq 119.15.155.114`
• AWS WAF: `Addresses: ["119.15.155.114/32"]`

Assessment

While the IP shows moderate risk, it demonstrates limited activity with no open services or active scanning behavior. The primary concern stems from DNSBL listings indicating prior reputation issues. The subnet context remains relatively clean, suggesting this may represent a legacy or dormant address rather than an actively malicious endpoint.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.