202.70.152.132
IP INTELLIGENCE BRIEFING
Target: 202.70.152.132/32
Classification: Moderate Risk (Score: 55/100)
Report Date: Current
---
OWNERSHIP & NETWORK ATTRIBUTES
The IP address is assigned to ASN 9557, registered under the organization "Munir Ahmed" with netname PTCLBB-PK under APNIC RIR jurisdiction. The /24 subnet (202.70.152.0/24) falls within the 202.70.144.0/20 block. Geolocation data presents conflicting signals with origin data indicating Pakistan but probe results locating the IP in Marseille, France—indicating geolocation inconsistency.
THREAT INDICATORS
No active threat indicators detected. The IP is not classified as a Tor exit node, known attacker, or spam source. Blacklist count stands at zero. However, the control plane shows 3 DNSBL listings out of 8 total lists, and route stability is flagged as false. No known malware campaigns or threat feeds correlate with this address.
NETWORK BEHAVIOR
Active service: SSH (port 22/tcp). Forward DNS resolution confirmed as false with zero forward hostnames. The IP operates as a single-service host. No TLS certificates or HTTP services detected.
NEIGHBORHOOD ANALYSIS
Subnet abuse density: 0.3333 (low). The /24 subnet contains 3 total siblings with 2 active. Risk distribution across neighbors shows 1 medium-risk and 1 low-risk address. The subnet is classified as "mostly_clean" with inherited risk level of 2.
HISTORICAL OBSERVATIONS
Fifteen signal observations recorded, with the most recent activity observed on 2026-07-29. No persistent malicious behavior detected. Ownership changes recorded at zero, indicating stable assignment.
RECOMMENDED ACTIONS
Given the elevated risk score (55/100), the following countermeasures are recommended:
*Firewall Blocking:*
- iptables: `iptables -A INPUT -s 202.70.152.132 -j DROP`
- nftables: `nft add rule inet filter input ip saddr 202.70.152.132 drop`
- nginx: `deny 202.70.152.132;`
*Cloud Platform Rules:*
- Cloudflare WAF: Block via expression `ip.src eq 202.70.152.132`
- AWS WAF: Add to rule set with CIDR 202.70.152.132/32
*Monitoring:* Increase logging verbosity and review recent activity from this IP due to the moderate risk classification.
---
ASSESSMENT: This IP presents moderate risk primarily due to DNSBL listings and geolocation inconsistencies. While no active malicious indicators are present, the risk score warrants defensive blocking with enhanced monitoring capabilities.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Munir Ahmed |
| ASN | AS9557 |
| Network Name | PTCLBB-PK |
| CIDR Block | 202.70.144.0/20 |
| RIR | APNIC |
| Country | PK |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Single-Service Host |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 22 | ssh | tcp | — |
| Closed Ports | 25, 80, 443, 3389, 8080, 8443 (1 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 35% | 2 | 2 |
| routing | 25% | 1 | 1 |
| services | 25% | 1 | 1 |
| ownership | 0% | 0 | 0 |
| reputation | 25% | 1 | 1 |
| geolocation | 0% | 0 | 0 |
| Overall | 18% | 5 | 5 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Low (35%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-23 20:05:39 UTC |
| Last Seen | 2026-07-29 20:08:13 UTC |
| Profile Built | 2026-07-29 20:17:23 UTC |
| Data Freshness | Live |
| Signal Types | 17 |
| Total Observations | 17 |
Full dossier details are available via our API.