120.56.165.124📋 Copy

# IP Intelligence Briefing: 120.56.165.124/32

## Executive Summary

IP address 120.56.165.124/32 is classified as High Risk (Risk Score: 80) with no active threat indicators currently detected. The IP belongs to MTNL infrastructure under the organization "Amarjeetkaur Bedi" (ASN: 9829). The address appears to be firewalled with no open services, though control plane data indicates 4 DNSBL listings out of 8 total checks.

## Technical Profile

## Network & Infrastructure Analysis

Service Status: No open ports or active services detected. The IP is classified as "Firewalled / No Services." No TLS certificates, HTTP banners, or domain resolutions observed.

Control Plane: Route stability is flagged as unstable (isRouteStable: false). The IP appears in 4 DNSBL lists, suggesting historical reputation concerns. Operator score: 0.1304 (Minimal).

Geographic Validation: ICMP probing was blocked during validation. The IP shows geographic distance of 7,823.5km from validation point with 1,500km accuracy radius.

## Historical Observations

Analysis of 15 observation signals (most recent: 2026-07-31) reveals:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 0
• Classification: Not persistently malicious

Recent signals indicate consistent ownership under MTNL with no changes. Ownership records point to APNIC RIR with abuse contact: abusemtnl@bol.net.in.

## Neighborhood Analysis

Subnet: 120.56.165.124/24

• Abuse Density: 0 (Clean)
• Total Siblings: 1
• Active Siblings: 0
• Threat Siblings: 0

No neighboring IPs detected with threat indicators. The /24 subnet shows clean classification with no inherited risk from adjacent addresses.

## Threat Indicators

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Correlation: No matching certificates or correlated IPs
• Campaign Likelihood: Not detected

## Recommended Actions

1. Monitor: Despite high risk score, no active threat indicators warrant immediate blocking. Monitor for changes in service status or DNSBL listings.

2. Block if: New threat indicators emerge or DNSBL listings increase.

3. Contact: For abuse reporting, use abusemtnl@bol.net.in

4. Context: The high risk score may reflect historical reputation or infrastructure metadata rather than active malicious activity.

## Intelligence Assessment

The IP address presents a low immediate threat despite the high risk score. The absence of open services, combined with a clean neighborhood profile and no active threat indicators, suggests the risk classification may be based on historical data or network metadata. SOC analysts should maintain monitoring but no immediate defensive action is required unless new threat indicators surface.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.