128.65.104.94📋 Copy

# IP Intelligence Briefing: 128.65.104.94/32

## Executive Summary

IP address 128.65.104.94 is associated with BA-TELEMACH (Telemach BH d.o.o.) in Sarajevo, Bosnia and Herzegovina. Current risk assessment indicates Low Risk (Score: 25). The IP demonstrates stable ownership characteristics with no active malicious indicators, though it maintains a minimal DNSBL listing.

## Ownership and Infrastructure

• ASN: 42560 (BA-TELEMACH-AS)
• Organization: Telemach BH d.o.o.
• Location: Sarajevo, Federation of Bosnia and Herzegovina (BA)
• BGP Prefix: 128.65.104.0/21
• Registration: Allocated 2011-10-06 (RIR: RIPE NCC)

## Threat Assessment

The IP exhibits minimal threat characteristics:

• Risk Score: 25 (Low Risk)
• Abuse Confidence: Not elevated
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 1 DNSBL listing out of 8 total checked

The IP has no known campaigns, threat indicators, or correlated malicious activity. Control plane analysis shows the route is not stable (isRouteStable: false) but demonstrates minimal operator risk.

## Network Activity and Services

• Service Status: Firewalled / No Services
• Open Ports: None detected
• TLS Certificates: Not present
• DNS Resolution: Forward confirmed = false; no PTR records
• Email Authentication: No SPF or DMARC records configured

The absence of open services suggests this IP may be used for infrastructure purposes or is actively firewalled, which reduces exposure to direct attacks.

## Historical Observation

Fourteen observations recorded over the monitoring period show:

• Recent Activity: 2026-06-05 (multiple signals including ASN confirmation, operator scoring, and network scan data)
• Earlier Activity: 2026-05-30 (geolocation data)
• Ownership Changes: None (0)
• Threat Persistence Days: 0 (not persistently malicious)
• Threat Observation Count: 1

The IP demonstrates temporal stability with consistent ownership and geolocation attributes.

## Network Relationships and Neighborhood

• Relationships: 11 relationships identified, all linked to TELEMACH-BH network
• Subnet Analysis (128.65.104.0/24):

- Abuse Density: Minimal (0-1)

- Classification: Mostly clean

- Sibling Count: 1 threat sibling detected in neighborhood

• Risk Distribution: No high or medium risk neighbors detected

## Recommended Actions

Based on current risk profile, the IP does not require immediate blocking. However, SOC teams should:

1. Monitor for service activation (new open ports)

2. Verify any outbound traffic patterns against baseline

3. Track any changes to DNSBL status

4. Correlate with Telemach BH infrastructure for context

## Conclusion

IP 128.65.104.94 represents a legitimate infrastructure asset with minimal threat indicators. The absence of active services, combined with stable ownership history and low-risk classification, supports continued monitoring rather than restrictive action. No immediate security threats identified.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.