119.156.93.44📋 Copy

# IP Intelligence Briefing: 119.156.93.44/32

## Executive Summary

IP address 119.156.93.44 is classified as Moderate Risk (Score: 65/100). The address is geolocated to Burewala, Punjab, Pakistan (PK) and is associated with APNIC RIR under the PTCL network. Current profile indicates no active malicious indicators, but the elevated risk score warrants monitoring.

## Technical Profile

• Risk Score: 65 (Moderate Risk)
• Geolocation: Pakistan, Punjab, Burewala (30.16°N, 72.68°E)
• ASN: 17557
• BGP Prefix: 119.156.64.0/19
• Operator Score: 0.1304 (Minimal)
• DNSBL Listings: 3 of 8 total lists
• Network Role: Firewalled / No Services Detected

## Ownership & Attribution

• Organization: Munir Ahmed
• Abuse Contact: csirt@ptcl.net
• RIR: APNIC
• Registration: Data indicates ownership under PTCL network infrastructure

## Threat Indicators Assessment

• Malicious Indicators: None detected
• Blacklist Status: Listed on 3 DNSBL sources
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Campaign: No correlated campaign activity

## Network Behavior

• Open Services: None detected (ports closed or filtered)
• DNS Resolution: No reverse PTR records
• Forward Resolution: Inactive (0 forward hostnames)
• Email Reputation: No email authentication records (SPF/DMARC)
• Control Plane: Route stability flagged as unstable; 0 route changes in 30 days

## Historical Analysis (10 Observations)

Recent signal history shows:

• 2026-07-31: Multiple geolocation sources reporting Burewala, Punjab
• Organization: Consistent attribution to PTCL/Munir Ahmed
• Port Scanning: Activity detected (multiple ports probed)
• Operator Score: Maintained at 0.1304 (Minimal risk)
• Geographic Discrepancy: Some historical signals indicated Islamabad; current consensus shows Burewala

## Neighborhood Context

• Subnet: 119.156.93.0/24
• Abuse Density: 0%
• Threat Siblings: 0 detected
• High/Medium/Low Risk Neighbors: 0/0/0

## Recommended Actions

Immediate

1. Increase logging verbosity for traffic from 119.156.93.44

2. Review recent activity from this IP address

Firewall Rules (Recommended)

## Intelligence Assessment

This IP presents an elevated risk score despite lacking active malicious indicators. The combination of DNSBL listings, port scanning activity, and unstable routing classification suggests potential for future threat activity. However, no immediate malicious behavior has been observed. The IP is part of a low-abuse-density subnet with no related threat siblings.

Recommendation: Monitor activity patterns; implement blocking rules as a precautionary measure while maintaining logging for forensic analysis.

---

*Data sourced from IPDebrief intelligence platform. All analysis based on observed network signals and threat feeds.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.