5.119.226.133📋 Copy

# Intelligence Briefing: 5.119.226.133/32

## Executive Summary

IP address 5.119.226.133 presents a low-risk profile with a risk score of 15. The address belongs to IranCell Network Administrators (ASN 44244) within the Shiraz-Users network (5.119.0.0/16). No active threat indicators were detected, though geolocation data shows conflicting origin signals.

## Risk Assessment

Overall Risk Score: 15 (Low Risk)

Provider Score: 0

Authority Score: 0

Stability Score: 0

The IP maintains a low-threat classification with no active threat indicators. The address is not classified as a Tor exit node, known attacker, or spam source. Blacklist count stands at 0, with one DNSBL listing across 8 total lists.

## Ownership and Registration

• ASN: 44244
• Organization: IranCell Network Administrators
• Network Name: Shiraz-Users
• CIDR Block: 5.119.0.0/16
• RIR: RIPE
• Abuse Contact: abuse@mtnirancell.ir

## Geolocation Analysis

Conflicting geolocation signals detected:

• Primary Location: Frankfurt, DE (Europe/Berlin timezone)
• Secondary Signals: Shiraz, Fars, IR (Islamic Republic of Iran)
• Coordinates: 29.6106°N, 52.5245°E
• Consensus: False (geographic consensus not reached across sources)
• Geo-Plausibility: False

The conflicting geolocation data warrants monitoring. The IP appears routed through infrastructure that may originate from Iran but reports Frankfurt coordinates, suggesting potential anycast deployment or routing anomalies.

## Network Services and DNS

• Open Ports: None detected
• DNS PTR Records: Empty
• Forward Resolution: Not confirmed
• Hosted Domains: 0
• Email Authentication: No SPF or DMARC records detected
• HTTP Services: No active web services (firewalled/no services)

## Control Plane and Routing

• BGP Prefix: 5.119.224.0/20
• Route Stability: False (not stable)
• Route Changes (30-day): 0
• RPKI State: Null
• DNSSEC Valid: True
• Traceroute Analysis: 30 hops with 21 timeouts; transit through Comcast

## Neighborhood Analysis

• Subnet: 5.119.226.133/24
• Abuse Density: 0
• Total Siblings: 0
• Active Siblings: 0
• Threat Siblings: 0

The /24 subnet contains no neighboring IPs and shows zero abuse density.

## Observation History

Fourteen historical observations recorded, with recent activity from 2026-07-24. Signals indicate:

• Consistent ownership without changes
• No persistent malicious behavior detected
• Multiple geolocation signals from various sources
• No threat observation count accumulated

## Threat Indicators

• Blacklist Count: 0
• Known Campaigns: None
• Pulsedive Risk: Null
• Certificate Matches: 0
• Banner Matches: 0
• Correlated IPs: 0

## Recommended Actions

Based on the current risk profile (15/100), the following actions are recommended:

1. Monitoring: Continue passive observation. The low risk score and lack of threat indicators support a monitor-only approach.

2. Blocking: No immediate blocking required. However, consider policy-based blocking due to conflicting geolocation signals.

3. Firewall Rules: No specific firewall rules generated due to low-risk classification and no open services.

4. DNSBL Monitoring: Monitor for changes in DNSBL listing status (currently 1 of 8 lists).

## SOC Analyst Notes

• The conflicting DE/IR geolocation signals warrant periodic review.
• Network stability flags suggest potential routing infrastructure changes.
• The 5.119.0.0/16 block is under IranCell Network Administrators; assess organizational risk policies accordingly.
• No active threat activity detected; maintain baseline monitoring posture.

---

*Data Source: IPDebrief Intelligence Platform*

*Analysis Date: 2026-07-24*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.