43.165.170.198📋 Copy

# IP Intelligence Briefing: 43.165.170.198

## Executive Summary

IP address 43.165.170.198 presents a Low Risk profile with an overall risk score of 25. The address is assigned to IRT-ACEVILLEPTELTD-SG (ASN 132203) within the 43.165.128.0/18 CIDR block. No active services, open ports, or known malicious indicators were detected. Current classification is "clean" with no threat siblings identified in the local /24 subnet.

## Ownership and Registration

• Organization: IRT-ACEVILLEPTELTD-SG
• ASN: 132203
• CIDR Block: 43.165.128.0/18
• RIR: APNIC
• Abuse Contact: abuse@tencent.com
• Network Name: ACEVILLEPTELTD-SG

## Geolocation Analysis

Reported location: New York, US (US-NY). However, geolocation consensus is unresolved with multiple conflicting data sources. Historical observations have reported locations in China (CN) and Japan (JP) with varying confidence levels, indicating potential routing anomalies or data inconsistencies.

## Threat Indicators

• Reputation: Low Risk
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0 (current profile shows 0, though control plane data indicates 1 DNSBL listing out of 8 total checks)
• Active Threat Indicators: None detected
• Known Campaigns: None identified

## Network Services and DNS

• Open Ports: None detected
• TLS Certificate: None
• HTTP Services: None
• Hosted Domains: 0
• PTR Records: None
• Forward Resolution: Not confirmed
• Email Authentication: SPF and DMARC records not present

## Neighborhood Analysis (43.165.170.0/24)

• Abuse Density: 0 (clean)
• Total Siblings: 3
• Active Siblings: 2
• Threat Siblings: 0
• Neighbor Risk Distribution: 1 medium (43.165.170.19, score 50), 1 low (43.165.170.119, score 25), 0 high
• Overall Classification: Clean

## Historical Observations

13 observations recorded. Recent activity includes:

• 2026-07-22: Geolocation signals showed conflicting data (CN, JP, US) with confidence levels between 30-95%
• 2026-07-22: Threat indicators observed with confidence 0.95, showing multiple pulse detections
• Ownership stability: No changes recorded
• Threat persistence: 0 days
• Not classified as persistently malicious

## Routing and Control Plane

• Origin ASN: 132203
• BGP Prefix: 43.165.128.0/18
• Route Stability: Unstable (isRouteStable: false)
• Route Changes (30d): 0
• MOAS: No
• RPKI State: Not available
• IRRC Consistency: Not available
• DNSSEC: Valid
• Hop Count: 14
• Transit Networks: Comcast

## Recommended Actions

No specific firewall rules or blocking recommendations are generated due to the low-risk classification. However, the following monitoring considerations apply:

1. Monitor for Service Changes: No open ports detected; monitor for any service provisioning that could change the IP's role

2. Track Geolocation Consistency: Conflicting location data (US, CN, JP) warrants continued observation

3. Subnet-Wide Awareness: One neighbor (43.165.170.19) shows medium risk (score 50); monitor subnet activity

4. DNSBL Monitoring: 1 DNSBL listing detected in control plane data; verify if listing applies to this specific IP or subnet

5. Email Authentication: Absence of SPF/DMARC records may affect deliverability if mail services are added

## SOC Analyst Notes

This IP currently operates as a firewalled endpoint with no exposed services. The low-risk score (25) combined with clean subnet classification (0 abuse density) suggests benign usage. However, the geolocation inconsistencies and route stability flags warrant periodic re-evaluation. No immediate action required; maintain standard monitoring protocols.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.