59.103.104.100📋 Copy

# IP Intelligence Briefing: 59.103.104.100/32

## Executive Summary

IP address 59.103.104.100 is a Pakistan-based infrastructure address with a low-risk profile (Risk Score: 25). The IP belongs to CYBERNET-PK (ASN 9541) and is geolocated to Lahore, Punjab. Current analysis indicates minimal immediate threat, though 1 DNSBL listing and 12 historical threat pulses warrant monitoring.

## Profile Overview

Ownership & Registration

• ASN: AS9541 (cyber internet services (pvt) ltd.)
• Organization: Munir Ahmed / CYBERNET-PK
• RIR: APNIC (Asia-Pacific)
• CIDR Block: 59.103.104.0/24
• Network Classification: Firewalled / No Services

Geolocation

• Country: Pakistan (PK)
• Region: Punjab
• City: Lahore
• Coordinates: 31.49°N, 74.37°E
• GeoSource Consensus: Validated

Threat Indicators

• Risk Score: 25/100 (Low Risk)
• Abuse Confidence: Not elevated
• Is Tor Exit: No
• Is Known Attacker: No
• Is Spam Source: No
• Blacklist Count: 1 (listed on 1 of 8 total DNSBLs)
• Operator Score: 0.1304 (Minimal)
• Route Stability: False (routing inconsistencies detected)

Network Services

• Open Ports: None detected
• TLS Certificate: None
• HTTP Title: None
• Reverse DNS (PTR): None
• Forward Resolution: None
• Email Authentication: No SPF/DMARC records

## Observation History

Total observations: 14

Recent signal activity (2026-07-24):

• Geolocation signals from Alienvault OTX and MaxMind GeoLite2 consistently report Lahore, Pakistan
• One signal flagged "has_threats": true with pulse count of 12 (requires correlation analysis)
• No ownership changes detected
• No persistent malicious behavior indicators

Temporal analysis shows 0 threat observation count and 0 threat persistence days. The IP is not classified as persistently malicious.

## Relationship Graph

Relationships detected: 3

• Type: Same Network (CYBERNET-PK) [repeated 3x]
• No associations with external organizations, hostnames, or certificates

## Neighborhood Analysis

Subnet: 59.103.104.0/24

• Total Siblings: 4
• Active Siblings: 0
• Threat Siblings: 0
• Abuse Density: 0
• Classification: Clean

Sibling IP Risk Distribution:

All sibling IPs show low-to-moderate risk scores (0-25). No high-risk neighbors detected.

## Recommended Actions

Based on current risk assessment (Score: 25), no immediate firewall or blocking actions are recommended. The IP does not trigger automatic security actions.

Recommended Monitoring Indicators:

1. DNSBL listing count (currently 1)

2. Historical threat pulse count (currently 12)

3. Route stability anomalies (currently false)

## Intelligence Assessment

Threat Level: LOW

The IP address presents minimal immediate risk. It is a legitimately registered infrastructure address with no active services, no open ports, and no evidence of malicious activity in current scans. The single DNSBL listing and historical threat pulses should be investigated if they correlate with specific incidents, but in isolation they do not warrant blocking.

Key Observations:

• Legitimate ASN registration with APNIC
• No Tor/VPN/proxy characteristics
• Residential/Cloud/Hosting: No
• No active threat campaigns or correlated IPs
• Neighborhood shows clean classification with low abuse density

SOC Analyst Guidance:

• Monitor for any changes in DNSBL listings
• Correlate historical threat pulses (12) with specific incident timestamps if available
• No immediate blocking required; allow-list or monitor as needed

---

*Report generated: 2026-07-24*

*Data Source: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.