106.192.16.173📋 Copy

# IP Intelligence Briefing: 106.192.16.173/32

## Executive Summary

IP address 106.192.16.173 presents a Moderate Risk profile (Risk Score: 40). The address is associated with Bharti Airtel mobile infrastructure in Hyderabad, India, with no active threat indicators currently observed. Recommended action is defensive blocking pending further contextual analysis.

## Ownership and Infrastructure

The IP is classified as mobile infrastructure (Airtel carrier: LTE/5G) with no hosting, CDN, or proxy characteristics. The connection type is residential/mobile rather than enterprise infrastructure.

## Threat Assessment

• Overall Risk Score: 40 (Moderate Risk)
• Abuse Confidence Score: Not available
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Blacklist Count: 0
• Threat Feeds: No active matches

Control Plane Data

• DNSBL Status: Listed on 2 of 8 DNSBL sources
• Route Stability: Unstable (route changes observed)
• Operator Score: 0.1304 (Minimal)
• RPKI Status: Not validated

## Network Neighborhood Analysis

Subnet: 106.192.16.173/24

• Abuse Density: 0% (Clean)
• Threat Siblings: 0
• Active Siblings: 0
• Total Siblings: 1

The immediate /24 subnet shows no evidence of malicious activity or associated threat actors. No neighboring IPs flagged for abuse.

## Service and Port Analysis

• Open Ports: None detected
• HTTP/HTTPS: No services responding
• TLS Certificate: None
• Service Purpose: Firewalled / No Services
• Forward Resolution: Unconfirmed

The IP does not expose any services to the internet. No open ports or web application banners were observed during scanning.

## Historical Activity

15 observations recorded as of July 27, 2026:

• Ownership Changes: 0
• Threat Persistence: None observed
• Observation Count: 0 persistent threats
• Classification: Clean subnet classification inherited

Geo-validation shows ICMP blocked during probing, with a minimum possible RTT of 145ms from probe location. Geolocation data indicates consistent placement in Hyderabad, India.

## Related Entities

Three relationship entries identified, all pointing to the same network entity (MOHALI-UN). No external relationships to organizations, hostnames, or certificates were discovered.

## Recommended Actions

Based on the moderate risk score (40) and the recommendation to block:

Firewall Rules

```bash

# iptables

iptables -A INPUT -s 106.192.16.173 -j DROP

# nftables

nft add rule inet filter input ip saddr 106.192.16.173 drop

# nginx

deny 106.192.16.173;

# pfSense

106.192.16.173/32

# Cloudflare WAF

{"description":"Block 106.192.16.173 — IPDebrief risk score 40","action":"block","filter":{"expression":"ip.src eq 106.192.16.173"}}

# AWS WAF

{"Addresses":["106.192.16.173/32"],"Description":"IPDebrief risk 40"}

```

## Intelligence Summary

This IP belongs to Bharti Airtel's mobile network infrastructure in Hyderabad, India. While currently showing moderate risk characteristics (DNSBL listings, unstable routing), no active threat indicators, campaigns, or malicious behavior have been observed. The subnet is clean with no associated threat actors.

Recommendation: Implement blocking at the perimeter firewall level due to moderate risk score. Monitor for any changes in threat indicators or service exposure. Given the mobile carrier association, false positives are possible; correlate with legitimate traffic patterns before implementing permanent blocks.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.