202.47.34.52📋 Copy

INTELLIGENCE BRIEFING: 202.47.34.52

---

**SUMMARY**

The IP address 202.47.34.52 is associated with ASN 9541 (CYBERNET-PK) under organization Amjad Qasmi. The address is geolocated to Karachi, Sindh, Pakistan. The IP carries a moderate risk score of 50 and is currently classified as firewalled with no active services or open ports.

**OWNERSHIP & INFRASTRUCTURE**

• ASN: 9541 (cyber internet services (pvt) ltd.)
• Organization: Amjad Qasmi
• Network Block: 202.47.32.0/23 (CYBERNET-PK)
• RIR: APNIC
• Registration: Data unavailable

**GEOLOCATION**

• Country: Pakistan (PK)
• Region: Sindh
• City: Karachi
• Coordinates: 24.86°N, 67.00°E
• Geo Sources: 2 (consensus confirmed)

**THREAT INDICATORS**

• Risk Score: 50 (Moderate)
• Blacklist Status: Listed on 2 DNSBL entries out of 8 total lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Associations: None identified
• Control Plane: Route stability flag set to false; operator score 0.1304 (Minimal)

**NETWORK SERVICES**

• Open Ports: None detected
• DNS Resolution: No PTR records; forward resolution failed
• TLS/Certificates: None
• HTTP: No active web services
• Classification: Firewalled / No Services

**NEIGHBORHOOD ANALYSIS**

• Subnet: 202.47.34.52/24
• Abuse Density: 0 (clean)
• Active Siblings: 0
• Threat Siblings: 0
• Risk Distribution: No high, medium, or risk flags in subnet

**OBSERVATION HISTORY**

Fourteen signal observations were recorded. The most recent activity (2026-07-31) included port scanning, ownership verification, subnet classification, and geolocation checks with threat flags. One signal indicated "has_threats": true with 2 associated threat pulses. No persistent malicious behavior was detected over the observation period.

**RELATIONSHIPS**

Three relationship records exist, all pointing to the CYBERNET-PK network. No additional organizational, hostname, or certificate relationships were identified.

**RECOMMENDED ACTIONS**

Based on the risk profile, the following defensive measures are recommended:

**ASSESSMENT**

The IP address presents moderate risk with no active services and a clean neighborhood profile. The 2 DNSBL listings suggest potential reputation issues requiring monitoring. The lack of persistent malicious activity and zero threat siblings indicates this IP may be a dormant or misconfigured endpoint rather than an active threat actor. SOC teams should consider blocking based on organizational policy, particularly given the DNSBL listings and moderate risk classification.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.