203.128.29.115📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 203.128.29.115/32

Date: 2026-07-31

Classification: Moderate Risk (Score: 50)

---

## EXECUTIVE SUMMARY

IP 203.128.29.115 is a Pakistan-based infrastructure address with moderate risk scoring (50). The IP is owned by IRT-BRAINNET-PK (ASN 141342) in the BRAINNET-PK /24 block and shows no active threat indicators. While the address itself is clean, it is listed on 2 of 8 DNSBLs, and the subnet exhibits minimal threat activity.

---

## OWNERSHIP AND GEOLOCATION

Organization: IRT-BRAINNET-PK

ASN: AS141342

CIDR Block: 203.128.29.0/24

Geolocation: Karachi, Sindh, Pakistan (PK)

RIR: APNIC

Registration: No public registration date available

---

## THREAT PROFILE

Risk Score: 50 (Moderate)

Abuse Confidence: Null

Threat Indicators: None detected

Blacklist Status: Listed on 2 of 8 DNSBLs

Campaign Associations: None

Known Attacker: No

Tor Exit Node: No

Spam Source: No

Service Analysis: No open ports detected. Service classification: "Firewalled / No Services"

---

## NETWORK CONTEXT

Subnet Classification: Clean

Subnet Abuse Density: 0

Threat Siblings in /24: 0

Total Active Siblings: 2

Neighbor Risk Scores:

• 203.128.29.105: Risk 25 (Low)
• 203.128.29.152: Risk 25 (Low)

Control Plane:

• BGP Prefix: 203.128.29.0/24
• Route Stability: False
• RPKI State: Unknown
• Route Changes (30d): 0

---

## DNS INFRASTRUCTURE

PTR Hostname: 203-128-29-115.braintel.net.pk

Forward Resolution: Not confirmed

Hosted Domains: None

Email Authentication: SPF: No, DMARC: No

TXT Records: 0

---

## OBSERVATION HISTORY

Total observations: 16 signals recorded through 2026-07-31

Key Historical Signals:

• Subnet classification consistently "clean" with 0 abuse density
• Geolocation signals from multiple sources (MaxMind Geolite2, AlienVault OTX)
• Operator score: 0.1304 (Minimal risk)
• No persistent malicious behavior detected

---

## RELATIONSHIP MAPPING

Network Associations: BRAINNET-PK (3 entries)

DNS Associations: 203-128-29-115.braintel.net.pk (3 entries)

Organizations: IRT-BRAINNET-PK

Certificates: None

---

## RECOMMENDED ACTIONS

Firewall Rules (Block Recommended)

iptables:

```

iptables -A INPUT -s 203.128.29.115 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 203.128.29.115 drop

```

nginx:

```

deny 203.128.29.115;

```

pfSense:

```

203.128.29.115/32

```

Cloudflare WAF:

```json

{

"description": "Block 203.128.29.115 — IPDebrief risk score 50",

"action": "block",

"filter": {

"expression": "ip.src eq 203.128.29.115"

}

}

```

AWS WAF:

```json

{

"Addresses": ["203.128.29.115/32"],

"Description": "IPDebrief risk 50"

}

```

---

## ANALYST NOTES

This address represents a firewalled infrastructure endpoint with no active services or open ports. While the IP itself shows no threat indicators, the DNSBL listings warrant monitoring. The subnet environment is relatively clean with no threat siblings detected. The moderate risk score (50) primarily reflects DNSBL listings rather than active malicious behavior. Recommend blocking at perimeter controls if not already in place.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.