138.252.131.21📋 Copy

# IP Intelligence Briefing: 138.252.131.21/32

Classification: Low Risk | Date: Current Analysis | Status: Routine Monitoring

---

## Executive Summary

IP address 138.252.131.21 is a low-risk address associated with IRT-NAYSWAN-PH (NAYSWAN-PH) in the Philippines. The IP shows no threat indicators, no malicious activity, and no open services. It operates as a CGNAT (Carrier-Grade NAT) endpoint with standard ISP infrastructure characteristics. No defensive action required.

---

## Ownership & Registration

• Organization: IRT-NAYSWAN-PH
• Netname: NAYSWAN-PH
• ASN: 154335
• CIDR Block: 138.252.130.0/23
• RIR: ARIN
• Abuse Contact: Available via RDAP

---

## Geolocation

• Country: Philippines (PH)
• Region: Caraga
• City: Santa Maria
• Timezone: Asia/Manila
• Geo Confidence: Consensus verified across multiple sources

---

## Network Classification

• Role: Firewalled / No Services
• Infrastructure Type: Residential ISP CGNAT
• Provider: ISP (IRT-NAYSWAN-PH)
• Proxy/Tor: Negative on all indicators
• Cloud/Hosting: Negative
• Mobile: Negative

---

## DNS Analysis

• PTR Hostname: cgnat-138-252-131-21.nayswannetwork.com
• Domain: nayswannetwork.com
• Email Authentication: SPF ✓, DMARC ✓
• Forward Resolution: 1 hostname confirmed
• DNSSEC: Valid
• Reverse DNS: Active and consistent

---

## Threat Intelligence

• Risk Score: 0/10
• Abuse Confidence Score: Not applicable (no abuse signals)
• Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Threat Feeds: None
• Campaign Correlation: None

---

## Services & Ports

• Open Ports: None detected
• TLS Certificate: None
• HTTP Service: None
• Server Banner: None

---

## Control Plane

• BGP Prefix: 138.252.131.0/24
• Origin ASN: 154335
• Route Stability: Not stable (0 route changes in 30 days)
• RPKI State: Not evaluated
• Operator Score: 0.1304 (Minimal)
• DNSBL Listed: 0/8 lists

---

## Neighborhood Analysis

• Subnet: 138.252.131.0/24
• Neighbor Count: 0
• Abuse Density: 0
• High Risk Neighbors: 0
• Medium Risk Neighbors: 0
• Low Risk Neighbors: 0

---

## Historical Observations

Total observations: 15

Recent Signals (2026-07-25):

• Network Classification: Consistent (not CDN, not Tor, not VPN, not proxy, not mobile, not anycast, not hosting, not residential)
• Ownership: No changes detected
• Geolocation: Philippines (confidence 0.52, accuracy ±600km via multi-signal inference)
• Operator Score: Minimal (raw score 0.15)
• Overall Risk: Consistent low-risk profile

Temporal Analysis: No ownership changes, no persistent malicious activity, no threat persistence.

---

## Relationship Graph

• Network Associations: NAYSWAN-PH (3 instances)
• DNS Associations: cgnat-138-252-131-21.nayswannetwork.com (4 instances)

---

## Recommended Actions

No defensive actions required. This IP address presents no threat indicators and is classified as low risk. Standard network monitoring practices are sufficient.

---

## Analyst Notes

This IP belongs to NAYSWAN-PH, a Philippine ISP. The hostname pattern (cgnat-*) indicates this is a Carrier-Grade NAT address used for subscriber endpoint mapping. The absence of open services and the CGNAT designation align with normal ISP infrastructure behavior. The IP shows no association with known threat actors, campaigns, or malicious infrastructure.

Conclusion: This is legitimate ISP infrastructure. No blocking or filtering recommended. Continue standard monitoring.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.