93.1.104.227📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 93.1.104.227/32

Classification: Mobile Residential IP Address

Risk Assessment: Moderate (Score: 50/100)

Date of Analysis: 2026-07-22

---

## EXECUTIVE SUMMARY

IP 93.1.104.227 is a mobile carrier-allocated address (SFR France) associated with residential mobile broadband service. The IP shows moderate risk characteristics with no active threat indicators. Historical data indicates stable ownership and classification patterns. Recommended monitoring with defensive firewall rules.

---

## OWNERSHIP & GEOLOCATION

The IP resolves to reverse hostname `227.104.1.93.rev.sfr.net`, confirming mobile carrier infrastructure. Forward DNS resolution is confirmed with a single PTR record.

---

## THREAT INTELLIGENCE

Threat Status: CLEAN

• Abuse Confidence: Not applicable (no active threat signals)
• Blacklist Count: 0
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Campaign Association: No known campaigns

Control Plane Indicators:

• DNSBL Listings: 2 of 8 total lists
• Route Stability: False
• Operator Score: 0.2609 (Basic)
• DNSSEC: Valid

---

## NETWORK ENVIRONMENT

Neighborhood Analysis (93.1.104.0/24):

• Abuse Density: 0 (low)
• Neighbor Count: 1 active sibling
• Sibling IP: 93.1.104.124 (Risk Score: 40)
• Threat Siblings: 0

The /24 subnet shows minimal abuse activity with one neighboring IP exhibiting moderate risk classification.

---

## OBSERVATION HISTORY

Total Observations: 16 signals tracked

Recent Pattern Analysis:

• Ownership and geolocation data remain consistent across observation periods
• Classification consistently marked as "clean" to "moderate risk"
• ASN and organization records stable
• Geographic data shows minor variation between Orléans and La-Plaine-Saint-Denis Cedex (acceptable for mobile roaming)

Temporal Indicators:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Persistently Malicious: No

---

## SERVICE FINGERPRINT

• Open Ports: None detected
• TLS Certificate: None
• HTTP Service: None
• Banner Grab: None
• Classification: Firewalled / No Services

---

## SECURITY RECOMMENDATIONS

Action Level: Monitor / Defensive Block

Recommended Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 93.1.104.227 -j DROP

# nftables

nft add rule inet filter input ip saddr 93.1.104.227 drop

# Cloudflare WAF

ip.src eq 93.1.104.227 — action: block

# AWS WAF

Addresses: ["93.1.104.227/32"]

```

Assessment: While the IP lacks active threat indicators, the moderate risk score (50/100) combined with mobile residential classification warrants defensive blocking in sensitive environments. Consider monitoring for any behavioral changes or emerging threat signals.

---

## CONCLUSION

IP 93.1.104.227 is a legitimate mobile broadband address from SFR France with no active malicious activity. The moderate risk classification reflects the inherent characteristics of mobile residential IP allocation rather than confirmed malicious behavior. Implement defensive firewall rules and continue monitoring for signal changes.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.