27.34.65.120📋 Copy

# IP INTELLIGENCE BRIEFING: 27.34.65.120/32

## EXECUTIVE SUMMARY

IP 27.34.65.120 is classified as LOW RISK with a risk score of 0. The address belongs to WorldLink (ASN 17501), a Nepal-based ISP operating a dynamic residential broadband pool (CGNAT bypass). No active threat indicators, blacklists, or malicious campaigns were identified. The IP is firewalled with no open services and exhibits stable operational characteristics.

## NETWORK OWNERSHIP & CLASSIFICATION

• Organization: IRT-WLINK-NP (WorldLink)
• ASN: 17501
• Network Name: WLINK_BROADBAND_DYNAMIC_BRAS-JWL-02_INET-PRIORITY-POOL-CGNAT-BYPASS
• CIDR Block: 27.34.65.0/24
• RIR: APNIC
• Classification: Dynamic residential broadband pool (CGNAT)
• Service Purpose: Firewalled / No Services (no open ports)

## GEOLOCATION ANALYSIS

Geolocation data shows conflicting signals:

• Primary profile indicates US/MA (Boston) with geo consensus: false
• Historical signals indicate Kathmandu, Nepal (NP) with 0.70 confidence
• Geo sources: 2 sources, no consensus (geoPlausible: false)
• This discrepancy suggests dynamic residential IP routing with geolocation instability common in CGNAT pools

## THREAT POSTURE

Current Threat Status: CLEAN

• Risk Score: 0
• Abuse Confidence Score: Not applicable
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Blacklist Count: 0 (listed on 8 DNSBLs but 0 actual listings)
• Threat Persistence Days: 0
• Is Persistently Malicious: No

Threat Indicators: None detected across all threat feeds. No known campaigns, no correlation with malicious IPs.

## NETWORK BEHAVIOR & SERVICES

• Open Ports: None detected (firewalled)
• TLS Certificate: Not present
• HTTP Service: Not responding
• DNS PTR Record: 120.65.34.27.dynamic.wlink.com.np
• Forward Resolution: 1 hostname (com.np TLD)
• Control Plane: Route stability: false (1 route change in 30 days)
• BGP Prefix: 27.34.65.0/24

## SUBNET ANALYSIS (27.34.65.0/24)

• Total Neighbors: 6
• Abuse Density: 0.00
• Risk Distribution: 6 low risk, 0 medium, 0 high
• Neighbor Risk Scores:

- 27.34.65.38: 0

- 27.34.65.103: 0

- 27.34.65.158: 25 (elevated but not critical)

- 27.34.65.188: 0

- 27.34.65.209: 0

- 27.34.65.242: 0

• Subnet Classification: Clean residential broadband pool

## OBSERVATION HISTORY

• Total Observations: 14
• Latest Signal Date: 2026-07-24
• Historical Trends: Stable ownership, no persistence of malicious activity
• Key Signals:

- ASN 17501 consistently identified (confidence: 0.95)

- Organization IRT-WLINK-NP (confidence: 0.90)

- Nepal geolocation signals (confidence: 0.70)

- Operator score: 0.15 (Minimal risk)

## RELATIONSHIPS & ASSOCIATIONS

• Same Network: WLINK_BROADBAND_DYNAMIC_BRAS-JWL-02_INET-PRIORITY-POOL-CGNAT-BYPASS
• DNS Associations: 120.65.34.27.dynamic.wlink.com.np
• No Certificate Associations: No TLS certificates found
• No Email Authentication: No SPF/DMARC records

## SECURITY ACTIONS & RECOMMENDATIONS

Current Recommendation: NO ACTION REQUIRED

• Risk score of 0 indicates no immediate threat
• No firewall rules recommended
• No positive security actions indicated

Monitoring Considerations:

• Subnet 27.34.65.0/24 shows minimal abuse density
• One neighbor (27.34.65.158) carries risk score of 25; monitor for escalation
• Geolocation inconsistencies may require validation if this IP is observed in critical traffic
• Route instability (false isRouteStable) may indicate BGP renumbering activity

## INTELLIGENCE CONCLUSION

IP 27.34.65.120 represents normal residential broadband traffic from WorldLink's Nepal infrastructure. The absence of threat indicators, combined with zero risk scoring and clean subnet metrics, indicates benign operational activity. No blocking or alerting actions are warranted at this time. Routine monitoring of the /24 subnet is appropriate to track any emergence of malicious activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.