103.87.57.60📋 Copy

# Intelligence Briefing: 103.87.57.60/32

## Executive Summary

IP 103.87.57.60 presents a Moderate Risk profile (Risk Score: 40) associated with Excitel Broadband infrastructure in Delhi, India. The IP has been observed on multiple DNSBLs and shows recent malicious signal activity. Recommended action: Block at perimeter/ingress.

## Network Identification

• IP Address: 103.87.57.60/32
• ASN: 133982 (IRT-GLOBE012-IN)
• Organization: Excitel Broadband Private Limited
• Network Block: 103.87.56.0/22 (GLOBE012)
• Geolocation: Delhi, National Capital Territory of Delhi, India (APNIC RIR)
• Registration: Allocated 2017-03-06

## Threat Assessment

• Overall Risk Score: 40 (Moderate Risk)
• Blacklist Status: Listed on 2 of 8 threat feeds (max severity: high)
• Known Campaigns: None detected
• Tor/Proxy/VPN: Not identified
• Network Role: Firewalled / No Services

## Historical Activity

Observation history indicates active monitoring with 11 total signals recorded. Recent activity (2026-07-31) includes:

• Multiple blacklist listings with high-severity categorizations
• DNSSEC validation observed
• ASN routing confirmed via team-cymru-dns source
• No persistent malicious behavior flagged

## Neighborhood Analysis

• Subnet: 103.87.57.0/24
• Abuse Density: 0
• Adjacent IPs: 103.87.57.90 (Risk Score: 65, Medium Risk)
• Risk Distribution: 0 High, 1 Medium, 0 Low within observed neighborhood
• Total Siblings: 1 active neighbor detected

## Technical Observations

• Open Ports: None detected
• DNS Resolution: No PTR hostnames, no forward resolution
• HTTP Services: No active services detected
• Control Plane: Route stability false, origin ASN 133982
• BGP Prefix: 103.87.57.0/24

## Recommended Security Actions

Immediate: Block the IP at network ingress points.

Firewall Rules:

• iptables: `iptables -A INPUT -s 103.87.57.60 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 103.87.57.60 drop`
• Cloudflare WAF: Block with expression `ip.src eq 103.87.57.60`
• AWS WAF: Add address `103.87.57.60/32` to rule set

Additional Context:

The IP's neighbor 103.87.57.90 carries a higher risk score (65). Consider reviewing the entire /24 block for correlated activity. The subnet's abuse density remains low, suggesting localized rather than systemic compromise.

---

*Report generated based on IPDebrief intelligence data. Recommendations are probabilistic and should be validated against organizational threat context.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.