# IP Intelligence Briefing: 119.154.126.212/32
## Executive Summary
The IP address 119.154.126.212 presents a Moderate Risk profile (Risk Score: 55) with no active threat indicators. The IP belongs to PTCL (ASN 17557) but exhibits geographic inconsistencies. No open services or active malicious behavior observed. Recommended for monitoring but no immediate blocking required.
## Technical Profile
| Attribute | Value |
|---|---|
| **Risk Score** | 55 (Moderate) |
| **ASN** | 17557 (PTCL) |
| **Organization** | Munir Ahmed / Pakistan Telecommunication Company Limited |
| **CIDR Block** | 119.154.112.0/20 |
| **Geolocation** | France/Marseille (inconsistent) |
| **Service Status** | Firewalled / No Services |
| **DNSBL Listings** | 3 of 8 |
| **Route Stability** | Unstable |
## Threat Assessment
- Active Threat Indicators: None
- Known Campaigns: None
- Tor Exit/Proxy: No
- Known Attacker: No
- Spam Source: No
- Blacklist Count: 0 active, but 3 DNSBL listings exist
## Observations & Timeline
Fifteen signal observations recorded. Recent activity (2026-07-29) includes:
- Multiple network scans with low confidence (0.30-0.70)
- Alienvault-OTX signal indicating Pakistan-based threat presence with pulse associations
- No persistent malicious behavior observed
## Geographic Anomaly
Significant discrepancy detected: ASN 17557 is registered to Pakistan (PTCL), but geolocation data indicates France (Marseille). Geo validation flagged as implausible. This requires further investigation to determine if this indicates compromised infrastructure or data inconsistency.
## Network Context
- /24 Subnet: 119.154.126.212/24
- Abuse Density: 0
- Active Neighbors: 0
- Threat Siblings: 0
No other IPs in the immediate neighborhood show activity.
## Recommended Actions
1. Monitor: Place IP on watchlist for future activity
2. Investigate Geo Discrepancy: Verify true location via additional intelligence sources
3. DNSBL Review: Examine which 3 DNSBLs list this address to understand reputation impact
4. No Blocking Required: No active malicious behavior detected; risk is moderate, not critical
## SOC Analyst Notes
This IP shows moderate risk primarily due to geographic inconsistencies and limited DNSBL presence. The absence of open services, threat indicators, or neighbor abuse suggests this may be a dormant or misconfigured endpoint. Monitor for service activation or geo-verification updates.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
๐ข Ownership & Registration
| Organization | Munir Ahmed |
| ASN | AS17557 |
| Network Name | PTCL |
| CIDR Block | 119.154.112.0/20 |
| RIR | APNIC |
| Country | PK |
| Abuse Contact | Available via RDAP |
๐ DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No โ PTR hostname does not resolve back to this IP (weak signal) |
๐ DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
โ๏ธ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Unknown โ Insufficient routing data to classify |
๐ Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | โ |
| HTTP Title | โ |
๐ TLS Certificate
| SANs | None |
| Valid From | โ |
| Valid Until | โ |
๐ฏ Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 25% | 1 | 1 |
| routing | 25% | 1 | 1 |
| services | 25% | 1 | 1 |
| ownership | 25% | 1 | 2 |
| reputation | 0% | 0 | 0 |
| geolocation | 0% | 0 | 0 |
| Overall | 16% | 4 | 5 |
| Data Coherence | Mostly Consistent (80%) โ 1 contradiction(s) |
| Attribution | Low (35%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
๐ Observation Timeline ๐ Live
| First Seen | 2026-07-24 08:17:54 UTC |
| Last Seen | 2026-07-29 22:02:41 UTC |
| Profile Built | 2026-07-29 22:10:16 UTC |
| Data Freshness | Live |
| Signal Types | 17 |
| Total Observations | 17 |
Full dossier details are available via our API.