122.154.199.67📋 Copy

# Intelligence Briefing: 122.154.199.67/32

## Executive Summary

IP address 122.154.199.67 presents a low-risk profile with a risk score of 25. The address is classified as residential infrastructure owned by National Telecom Public Company Limited (ASN 9931, NTPCL-TH). No active threat indicators or known malicious campaigns were detected. The IP is listed on one DNS blacklist out of eight queried.

## Infrastructure Profile

• Organization: National Telecom Public Company Limited (NTPCL-TH)
• ASN: 9931
• CIDR Block: 122.154.0.0/15
• Infrastructure Type: Residential
• Network Role: Single-Service Host
• Geolocation: London, GB (accuracy radius not confirmed)
• Connection Type: Residential endpoint

## Threat Assessment

• Risk Score: 25 (Low Risk)
• Reputation: Low Risk
• Abuse Confidence: No confirmed abuse
• Blacklist Status: Listed on 1/8 DNSBLs
• Known Campaigns: None
• Tor/VPN/Proxy: No
• Cloud/VPS/Hosting: No

## Network Services

• Open Ports: 8080/tcp (HTTP-alt)
• DNS Resolution: None
• TLS Certificates: None
• Email Authentication: SPF and DMARC not configured

## Neighborhood Analysis

• Subnet: 122.154.199.0/24
• Abuse Density: 0.0 (clean)
• Threat Siblings: 0
• Active Siblings: 0
• Classification: Clean subnet with no inherited risk

## Historical Observations

Analysis of 14 signal observations reveals stable characteristics with no evidence of escalating threat behavior. The IP has demonstrated consistent residential classification, clean subnet membership, and no persistent malicious activity over the observation period.

## Relationships

• Network Associations: NTPCL-TH (2 relationships identified)
• No additional relationships to subnets, organizations, hostnames, or certificates beyond network classification

## Recommended Actions

Given the low-risk classification and clean neighborhood profile, no immediate blocking is recommended. However, the following monitoring actions are advised:

1. Monitor Port 8080: The open HTTP-alt service warrants passive observation for suspicious outbound connections or incoming traffic patterns.

2. DNSBL Review: Investigate the single DNSBL listing to determine the reason for inclusion.

3. Geolocation Verification: Confirm the reported London, GB location against actual traffic patterns, as this may be a Thai ASN showing UK geolocation (potential data inconsistency).

4. Baseline Traffic: Establish traffic baselines for this residential IP to detect anomalous behavior.

## Conclusion

122.154.199.67 is a low-risk residential endpoint with no current malicious indicators. The single DNSBL listing and open HTTP-alt service on port 8080 warrant passive monitoring but do not justify immediate blocking. The clean subnet profile and lack of threat siblings support continued observation rather than defensive action.

---

*Analysis Date: 2026-07-29*

*Data Source: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.