193.104.222.16📋 Copy

## Intelligence Briefing: 193.104.222.16/32

Executive Summary

IP 193.104.222.16 was assessed as Low Risk with a risk score of 25. The address operates as a firewalled endpoint with no active services, no open ports, and no TLS certificates. While the IP maintains a low individual risk profile, the surrounding /24 subnet exhibits mixed abuse characteristics with 8 medium-risk and 0 high-risk neighbors.

Technical Profile

• ASN/Provider: AS42201 (MNT-PVDATANET), RIR: RIPE
• Geolocation: London, England, GB (accuracy radius: 750km)
• DNS Resolution: 193-104-222-16.cust.norisab.net (norisab.net)
• Network Role: Firewalled / No Services
• Classification: Not CDN, proxy, VPN, Tor, hosting, or mobile

Threat Indicators

• Blacklist Status: Listed on 1 of 8 DNSBLs
• Known Indicators: None detected
• Tor/Spam/Attacker: Not flagged
• Campaign Correlation: No matches
• Persistence: No persistent malicious behavior observed

Neighborhood Analysis (193.104.222.0/24)

The subnet contains 19 sibling IPs with a risk distribution of 11 low, 8 medium, and 0 high-risk addresses. Notable neighbors include:

• 193.104.222.24 (risk: 65)
• 193.104.222.7, .8, .159 (risk: 50)
• Multiple IPs with risk scores of 25-40

The subnet abuse density was measured at 0.2778, indicating moderate activity levels.

Historical Observations

19 signal observations were recorded, with the most recent on 2026-06-25 showing minimal operator scoring (0.1304). Historical data includes geolocation inconsistencies with some records referencing Swedish network associations (SE-PVDATANET-20191115) and Telia Company (AS1299), suggesting potential routing or registration discrepancies.

Relationship Graph

• Network Associations: Multiple entries linked to SE-PVDATANET-20191115
• DNS Associations: 13 hostname entries resolving to 193-104-222-16.cust.norisab.net
• Control Plane: Route stability flagged as false; 0 route changes over 30 days

Security Recommendations

No specific firewall rules or blocking recommendations were generated due to the low-risk classification. The IP is not actively malicious but warrants monitoring due to:

1. DNSBL listing (1 of 8 lists)

2. Mixed-risk neighborhood context

3. Historical geolocation inconsistencies

SOC Analyst Action: Monitor for behavioral changes. No immediate blocking required. Correlate with any inbound/outbound traffic patterns from this address for additional context.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.