79.143.107.12📋 Copy

# IP INTELLIGENCE BRIEFING

Target IP: 79.143.107.12/32

Date: 2026-07-23

Risk Classification: Moderate Risk (Score: 40/100)

## EXECUTIVE SUMMARY

IP 79.143.107.12 is a low-service host registered to AS15397-MNT (One_Crna_Gora-MBB) with geolocation in Podgorica, Montenegro. The IP presents a moderate risk profile driven by DNSBL listings (2/8 lists), though no active threat indicators were observed. The IP is currently firewalled with no open services detected.

## NETWORK OWNERSHIP & GEOLLOCATION

• ASN: 15397 (AS15397-MNT)
• Organization: One_Crna_Gora-MBB
• CIDR Block: 79.143.107.0/24
• RIR: RIPE
• Location: Podgorica, Montenegro (ME) - Coordinates: 42.44°N, 19.26°E
• ABUSE CONTACT: ipnet@1.me

## THREAT INDICATORS

• Blacklist Count: 0
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• DNSBL Listings: 2 of 8 total lists

## NETWORK PROFILE

• Network Role: Firewalled / No Services
• Open Ports: None detected
• Active Services: None
• TLS Certificate: None
• DNS Resolution: No PTR records, no forward resolution

## NEIGHBORHOOD ANALYSIS (79.143.107.0/24)

• Abuse Density: 0%
• Subnet Classification: Clean
• Total Siblings: 2
• Active Siblings: 0
• Threat Siblings: 0
• Neighbor: 79.143.107.126 (Risk Score: 0)

The /24 subnet shows minimal abuse activity with only one low-risk neighbor detected.

## OBSERVATION HISTORY

• Total Observations: 12 signals collected
• Recent Classification: Clean
• Ownership Changes: 0
• Threat Persistence: None detected
• Signal Types Observed: Subnet classification, ownership data, geolocation, ASN registration

Historical analysis shows consistent classification with no emergence of malicious behavior or ownership changes.

## CONTROL PLANE DATA

• BGP Prefix: 79.143.96.0/20
• Route Stability: Unstable (isRouteStable: false)
• RPKI State: Not assessed
• DNSSEC: Valid
• Bogon Status: No
• Anycast: No

## RECOMMENDED ACTIONS

Given the moderate risk score and DNSBL presence, the following defensive measures are recommended:

Firewall Rules

• iptables: `iptables -A INPUT -s 79.143.107.12 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 79.143.107.12 drop`
• nginx: `deny 79.143.107.12;`

WAF Configuration

• Cloudflare WAF: Block IP with expression `ip.src eq 79.143.107.12`
• AWS WAF: Add 79.143.107.12/32 to block list

## ANALYST NOTES

The IP's moderate risk classification stems primarily from DNSBL presence despite the absence of active threat indicators. No open services were detected, limiting the attack surface. The subnet environment shows low abuse density. However, the DNSBL listings warrant continued monitoring. The IP is recommended for blocking until further evidence confirms benign activity.

Status: Monitor / Block Recommended

Confidence: Medium

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.