213.160.180.247📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 213.160.180.247/32

Date: 2026-06-23

Classification: High Risk Residential DSL

---

## EXECUTIVE SUMMARY

The IP address 213.160.180.247 is classified as High Risk (Risk Score: 70) with no active services detected. The address is associated with Telecom.sk residential DSL infrastructure in Pezinok, Slovakia, and appears on 4 of 8 DNSBLs with "high" severity ratings. While the /24 subnet shows zero abuse density, this isolated IP has been flagged for malicious activity.

---

## OWNERSHIP & GEOLOCATION

• ASN: 6855 (Jan Katuska)
• Network Provider: SK-TELECOM-2004
• Country: Slovakia (SK)
• Region/City: Bratislava Region, Pezinok
• Geolocation Accuracy: Moderate (2 sources, consensus: false)
• Registration: ASN allocated 1996-12-03 (10,789+ days old)

---

## THREAT INDICATORS

• Risk Score: 70/100 (High Risk)
• DNSBL Listings: 4/8 lists (High Severity)
• Known Attacker: No direct attribution
• Tor Exit Node: No
• Spam Source: No
• Campaign Association: None detected
• Operator Score: 0.1304 (Minimal)

---

## NETWORK ANALYSIS

• Service State: Firewalled / No Services
• Open Ports: None
• DNS: static-dsl-247.213-160-180.telecom.sk (forward confirmed)
• BGP Prefix: 213.160.160.0/19
• AS Path: 6939 → 6855
• Route Stability: Stable (0 changes in 30 days)

---

## OBSERVATION HISTORY

• Total Observations: 26 signals
• Recent Activity:

- 2026-06-23: Blacklist listing detected (8 lists, 3 active, max severity: high)

- 2026-06-18: ASN allocation confirmed, routing stable

• Threat Persistence: 1 observation day
• Persistent Malicious Activity: No

---

## NEIGHBORHOOD ANALYSIS

• Subnet: 213.160.180.247/24
• Abuse Density: 0% (Clean)
• Total Siblings: 1
• Threat Siblings: 0
• Inherited Risk: 0

---

## RELATIONSHIP MAPPING

• Same Network: SK-TELECOM-2004 (24 relationships)
• DNS Associations: static-dsl-247.213-160-180.telecom.sk (24 relationships)
• No External Threat Correlations: 0

---

## RECOMMENDED ACTIONS

---

## ANALYST NOTES

This IP represents a residential DSL connection that has been flagged for malicious activity despite being on a otherwise clean subnet. The lack of open services suggests either a compromised residential device or a connection used for outbound attacks. Given the subnet's clean abuse density, this may warrant monitoring rather than aggressive blocking. The DNSBL presence indicates prior abuse history, but the absence of persistent malicious activity patterns suggests the threat may be contained or intermittent.

SOC Team: Monitor for patterns; do not assume sustained threat.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.