120.89.104.25📋 Copy

# IP INTELLIGENCE BRIEFING

Target IP: 120.89.104.25/32

Classification: Residential ISP Connection

Date: 2026-07-25

Risk Level: Moderate (40/100)

---

## EXECUTIVE SUMMARY

IP 120.89.104.25 is a residential DSL connection registered to Nepal Telecom (NTCINTERNET) in Kathmandu, Nepal. The address presents moderate risk with no active threat indicators but demonstrates DNSBL listings and neighborhood proximity to elevated-risk peers. No services are currently open, and the IP is classified as residential with stable ownership.

---

## OWNERSHIP & GEOLOCATION

• Organization: IRT-NPTELECOM-NP (NTCINTERNET)
• ASN: 23752
• CIDR Block: 120.89.96.0/19
• Location: Kathmandu, Nepal (NP)
• Registration Authority: APNIC
• Abuse Contact: abuse_mail@ntc.net.np

---

## NETWORK ROLE CLASSIFICATION

• Connection Type: DSL (Residential)
• Infrastructure: Residential broadband
• Services: Firewalled / No Services (no open ports)
• Specializations: Not Cloud, CDN, VPN, Proxy, Tor, or Hosting

---

## THREAT INDICATORS

• Active Threats: None detected
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0 active blacklists
• Campaign Association: None identified

---

## DNS & CONTROL PLANE ANALYSIS

• PTR Hostname: 25-adsl.ntc.net.np
• DNSSEC: Valid
• DNSBL Status: Listed on 2 of 8 evaluated lists
• BGP Prefix: 120.89.104.0/24
• Route Stability: Unstable (fluctuations observed)
• Operator Score: 0.1304 (Minimal)

---

## NEIGHBORHOOD ANALYSIS (120.89.104.0/24)

• Subnet Risk Density: Low (abuse density: 0)
• Total Neighbors: 3
• Risk Distribution: 2 medium-risk, 1 low-risk

Adjacent IP Risk Scores:

---

## OBSERVATION HISTORY

• Total Observations: 15
• Recent Classification: Residential DSL connection
• Ownership Changes: 0
• Threat Persistence Days: 0
• Persistently Malicious: No

Recent signals confirm consistent residential infrastructure classification with no malicious activity patterns observed.

---

## RELATIONSHIP GRAPH

• Network Association: NTCINTERNET
• DNS Association: 25-adsl.ntc.net.np
• Related Entities: 2 relationships identified

---

## SOC ACTIONS & RECOMMENDATIONS

• Block Decision: Monitor / Log only (no immediate block required)
• Risk Justification: Moderate risk score driven by DNSBL listings and neighborhood proximity to elevated-risk peers
• Monitoring Priority: Medium
• Threat Context: Residential ISP connection with no active exploitation indicators

---

## INTELLIGENCE CONCLUSIONS

IP 120.89.104.25 represents a legitimate residential broadband endpoint from Nepal Telecom. While the moderate risk score warrants monitoring, no active threat indicators have been observed. The IP's proximity to two medium-risk neighbors in the same /24 subnet suggests potential for regional activity correlation. Recommended SOC posture: continue monitoring with no immediate blocking action required unless additional threat intelligence emerges.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.