27.147.220.200📋 Copy

# IP Intelligence Briefing: 27.147.220.200/32

Classification: Moderate Risk (Score: 40)

Date of Analysis: 2026-07-24

---

## Executive Summary

IP address 27.147.220.200 is a moderate-risk endpoint registered to Sajjid Pasha (AS23688, Link3-Technologies-Ltd). The IP shows no active threat indicators, no open services, and no known campaign affiliations. Geolocation data presents a significant inconsistency that warrants attention. The IP appears to be part of a residential or personal network segment with limited activity.

---

## Ownership and Network Context

• AS Number: 23688
• Organization: Sajjid Pasha
• Network Name: Link3-Technologies-Ltd
• CIDR Block: 27.147.220.8/29
• RIR: APNIC (Asia-Pacific)
• Registration: Available via RDAP
• Abuse Contact: abuse@link3.net

---

## Geolocation Analysis

Critical Finding: Geolocation data contains a significant inconsistency requiring investigation.

• Claimed Location: London, GB (Europe/London)
• Regional Data: Dhaka Division (inconsistent with UK assignment)
• Distance Violation: 7,528.2 km from claimed location
• Minimum Possible RTT: 150.6 ms
• Observed RTT: 292-300 ms average
• Geo-Plausible: True (despite regional inconsistency)

The distance violation between the claimed UK geolocation and regional data suggesting Dhaka, India, indicates either data quality issues or potential misrepresentation in network routing information.

---

## Threat Intelligence Profile

• Risk Score: 40/100 (Moderate Risk)
• Blacklist Count: 0
• DNSBL Listings: 2 of 8 total lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Affiliation: None identified

The IP shows no active threat indicators. Historical monitoring reveals 18 observations with no persistent malicious activity detected. The IP is not classified as a honeypot hit or actively enumerated target.

---

## Network Services and DNS

• Open Ports: None detected
• Service Classification: Firewalled / No Services
• PTR Record: 220.200.cetus.link3.net
• DNS Domain: link3.net
• Forward Resolution: 220.200.cetus.link3.net
• Email Authentication: SPF record present, DMARC configuration verified

No active services were discovered on the endpoint. The reverse DNS association with "cetus.link3.net" suggests this IP may be part of a hosted or residential network infrastructure.

---

## Neighborhood Assessment

• Subnet: 27.147.220.200/24
• Abuse Density: 0 (low activity neighborhood)
• Threat Siblings: None detected
• Active Siblings: 0

The /24 subnet shows minimal activity with no neighboring IPs flagged for abuse, indicating this IP exists in a relatively quiet network segment.

---

## Historical Observations

Monitoring data reveals 18 observations recorded with the following characteristics:

• Network classification signals: Clean classification with inherited risk of 0
• Geographic signals: Consistent RTT measurements (292-300 ms)
• Ownership signals: No recent ownership changes
• Subnet signals: Low abuse density maintained across observations

No temporal patterns suggest escalating risk or persistent malicious behavior.

---

## Relationship Graph

The IP associates with:

• Network: Link3-Technologies-Ltd (same network relationships)
• DNS Hostname: 220.200.cetus.link3.net (DNS associations)

No certificate or organizational relationships beyond the network and DNS associations were identified.

---

## Recommended Actions

Based on the moderate risk profile (40/100), the following defensive measures are recommended:

Immediate Firewall Rules

```bash

# iptables

iptables -A INPUT -s 27.147.220.200 -j DROP

# nftables

nft add rule inet filter input ip saddr 27.147.220.200 drop

# Nginx

deny 27.147.220.200;

```

WAF/Cloud Rules

• Cloudflare WAF: Block with expression `ip.src eq 27.147.220.200`
• AWS WAF: Add to rule set with address `27.147.220.200/32`

---

## SOC Analyst Notes

1. Monitor the geolocation inconsistency – The distance violation between claimed UK location and regional data suggesting Dhaka, India, warrants investigation. This may indicate routing manipulation or data quality issues.

2. Consider blocking – Despite moderate risk classification, the combination of DNSBL listings and geolocation inconsistencies suggests caution is warranted.

3. Subnet assessment – The /24 neighborhood shows low abuse density. If broader subnet investigation is required, consider correlating with other IPs in the 27.147.220.0/24 block.

4. No immediate threat – No active indicators of compromise, campaigns, or malicious behavior detected. Treatment as moderate-risk traffic with appropriate filtering.

---

Intelligence Product: IPDebrief

Report Generated: 2026-07-24

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.