106.201.76.203📋 Copy

IP INTELLIGENCE BRIEFING: 106.201.76.203/32

Classification: HIGH RISK (Score: 80/100)

Analysis Date: Current observation cycle

Jurisdiction: India (IN) - Gujarat, Ahmedabad

---

**Ownership & Infrastructure**

• ASN: 24560 (ABTS-DSL-MUM)
• Organization: Network Administrator
• Registration: APNIC RIR
• IP Block: 106.201.64.0/19 (ABTS-DSL-MUM netname)
• Network Role: Mobile broadband (LTE/5G) - Bharti Airtel carrier
• Service Type: Residential mobile connection (abts-mum-dynamic-203.76.201.106.airtelbroadband.in)

**Technical Profile**

• Open Ports: 80/tcp (HTTP), 443/tcp (HTTPS), 22/tcp (SSH)
• Web Server: nginx (HTTP/2.0 enabled)
• SSH Version: OpenSSH_9.4
• TLS Configuration: TLS 1.3, cipher suite TLS_AES_256_GCM_SHA384
• SSL Certificate: Self-signed pfSense certificate (issuer: pfSense-6a3d4bbbdb3d6)
• DNS Records: Airtel broadband dynamic hostname, SPF and DMARC configured
• HSTS: Enabled (max-age=31536000)

**Threat Indicators**

• DNSBL Status: Listed on 5 of 8 total blacklists
• Operator Score: 0.1304 (Minimal)
• Route Stability: Unstable (route changes detected in 30-day window)
• Threat Persistence: Single observation (non-persistent)
• Campaign Correlation: No known campaign associations
• Known Attacker/Spam/Tor Exit: Negative

**Geolocation & Context**

• Country: India (IN)
• Region: Gujarat
• City: Ahmedabad
• Coordinates: 20.59°N, 78.96°E (±1500km accuracy)
• Mobile Carrier: Bharti Airtel Ltd. (MCC 404, MNC 10)

**Network Neighborhood (106.201.76.0/24)**

• Subnet Classification: Mostly clean
• Abuse Density: Low (1/256)
• Threat Siblings: 1 identified within subnet
• Active Siblings: 0
• Inherited Risk Score: 2/100

**Observation History**

• Total Observations: 20 signals
• Recent Activity: HTTP responses with 200 status, 929ms TTFB
• Network Behavior: Standard web server responses, no anomalous patterns detected
• Temporal Risk Trend: Stable (single threat observation, non-persistent)

**Related Entities**

• Network: ABTS-DSL-MUM (appears in relationship graph)
• Hostnames: abts-mum-dynamic-203.76.201.106.airtelbroadband.in (DNS reverse association)
• No additional organizational or certificate relationships

---

**SOC ANALYST ACTIONS**

1. Firewall Rule Recommendation: Block or rate-limit due to DNSBL presence (5/8 lists) and high risk score (80)

2. Threat Hunting: Monitor for lateral movement from the 1 identified threat sibling in 106.201.76.0/24

3. Context: IP is associated with mobile broadband (Airtel DSL-MUM), suggesting potential residential/user-generated content rather than infrastructure compromise

4. False Positive Consideration: Self-signed certificate and route instability may indicate dynamic residential IP allocation; evaluate in context of specific alert type

5. Priority: Monitor for escalation. Current risk is elevated primarily due to blacklist associations, not active exploitation indicators

Summary: High-risk residential mobile broadband IP with DNSBL presence but no active exploitation indicators. Monitor subnet 106.201.76.0/24 for coordinated activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.