14.102.78.224📋 Copy

# IP Intelligence Briefing: 14.102.78.224/32

## Executive Summary

IP address 14.102.78.224 was classified as a Moderate Risk asset with a risk score of 40. The address belongs to IRT-WORLDPHONE-IN (WORLDPHONE-IN), ASN 133594, allocated within the APNIC RIR and registered in 2010. Geolocation data places the IP in New Delhi, National Capital Territory of Delhi, India. No active services or open ports were detected on the endpoint.

## Technical Profile

Ownership and Registration:

• Organization: IRT-WORLDPHONE-IN (WORLDPHONE-IN)
• ASN: 133594 (WPIS-AS - World Phone Infrastructure services private ltd, IN)
• Network Block: 14.102.78.0/24
• RIR: APNIC
• Registration Date: 2010-09-13

Network Role:

• Infrastructure Type: Firewalled / No Services
• Service Classification: Not identified as cloud, CDN, VPN, proxy, Tor, hosting, or mobile infrastructure
• Connection Type: Not specified

Geolocation:

• Country: India (IN)
• Region: National Capital Territory of Delhi
• City: New Delhi
• Coordinates: Latitude 20.59, Longitude 78.96
• Accuracy: 1,500 km radius
• GeoConsensus: Validated

## Threat Intelligence Assessment

Current Risk Posture:

• Overall Risk Score: 40 (Moderate Risk)
• Abuse Confidence Score: Not available
• Blacklist Count: 0
• DNSBL Listings: 2 out of 8 total lists
• Tor Exit Node: False
• Known Attacker: False
• Spam Source: False

Threat Indicators:

• No active threat indicators detected
• No known campaigns associated
• No associated threat feeds
• No active blacklists

Historical Observations:

• 11 signal observations recorded
• Recent activity observed as of 2026-07-22
• DNSSEC validation: Valid
• Route stability: Unstable
• BGP Prefix: 14.102.78.0/24

DNS Analysis:

• PTR Hostnames: None resolved
• Forward Resolution: Not confirmed
• Hosted Domains: 0
• Email Authentication: No SPF or DMARC records detected
• TXT Record Count: 0

## Neighborhood Analysis

The /24 subnet (14.102.78.0/24) was analyzed for neighboring IP addresses. Key findings:

• Abuse Density: 0
• Total Siblings: 1 active sibling detected
• Threat Siblings: 0
• Risk Distribution: No high, medium, or low risk neighbors identified
• Sibling IP: 14.102.78.237 (risk score not available)

## Relationship Graph

Three relationship entities were identified, all classified as "Same Network" relationships pointing to WORLDPHONE-IN. No additional relationships (hostnames, organizations, certificates) were detected beyond the network classification.

## Behavioral Analysis

• Honeypot Hits: 0
• Enumeration Strikes: 0
• WAF Violations: 0
• Total Incidents: 0
• Threat Persistence Days: 0
• Persistently Malicious: False

## Control Plane

• Origin ASN: 133594
• BGP Prefix: 14.102.78.0/24
• Route Changes (30d): 0
• Route Stability: False
• RPKI State: Not available
• IRR Consistency: Not available
• DNSSEC Valid: True
• DNSBL Listed Count: 2
• DNSBL Total Lists: 8

## Recommendations

Based on the Moderate Risk classification and DNSBL presence, the following security actions are recommended:

1. Monitoring: Monitor the IP for increased threat activity given its moderate risk score of 40

2. DNSBL Investigation: Investigate the 2 DNSBL listings to determine the nature of the blocks

3. Network-Level Controls: Consider implementing egress filtering for the 14.102.78.0/24 subnet

4. Baseline Establishment: Establish communication baselines with the ASN to identify deviations from normal behavior

5. Subnet Analysis: Investigate the single active sibling (14.102.78.237) to determine if correlation exists

6. Service Discovery: Continuously monitor for service openings on this IP or its subnet neighbors

## Conclusion

IP 14.102.78.224 presents a Moderate Risk profile with no active service exposure. The primary concern stems from DNSBL presence and the moderate risk score. While no direct attack indicators were observed, the combination of blacklist listings and moderate risk warrants continued monitoring and potential network-level controls. The long-standing registration date (2010) and infrastructure classification suggest this may be a legitimate infrastructure endpoint, though the DNSBL presence requires further investigation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.