106.219.144.202📋 Copy

# IP Intelligence Briefing: 106.219.144.202/32

Classification: Moderate Risk Mobile IP

## Executive Summary

IP address 106.219.144.202 is a mobile carrier IP belonging to Bharti Airtel (ASN: 24560, IRT-BHARTI-MO-IN). Assigned to the NOIDA-DELHI-NCR network block (106.219.128.0/19), this address carries a risk score of 40/100. The IP is currently firewalled with no open services and is listed on 2 of 8 DNSBLs.

## Network Ownership & Geolocation

• Organization: IRT-BHARTI-MO-IN (Bharti Airtel Ltd.)
• ASN: 24560 (APNIC)
• CIDR Block: 106.219.128.0/19
• Geolocation: Discrepancy noted between US Newark, NJ data and Indian carrier routing (MCC: 404, MNC: 10, LTE/5G technology)
• Abuse Contact: ip.misuse@airtel.com (via RDAP)

## Threat Assessment

• Risk Score: 40 (Moderate)
• Blacklist Status: Listed on 2 of 8 DNSBLs
• Known Threat Indicators: None
• Campaign Correlation: No known campaigns associated
• Is Tor/Proxy/VPN: No
• Current State: Firewalled/No Services detected

## Network Neighborhood Analysis

• Subnet: 106.219.144.0/24
• Abuse Density: 0
• Neighbor Count: 0
• Classification: Clean
• Active Siblings: 0
• Threat Siblings: 0

The /24 subnet shows no neighboring threat activity, with all risk metrics at baseline.

## Observation History

13 signal observations recorded. Most recent classification indicates "clean" with 0 abuse density and 0 inherited risk. No ownership changes detected. Threat persistence days: 0.

## Intelligence Narrative

This IP represents a mobile carrier allocation from Bharti Airtel's Indian infrastructure. The moderate risk score (40) combined with DNSBL listings suggests this address may be associated with elevated abuse patterns typical of mobile carrier IPs (e.g., botnet relays, compromised IoT devices). However, the current firewall state and absence of open services indicate the IP is not actively serving public-facing services.

## Recommended Actions

Based on the risk profile, defensive measures include:

Firewall Recommendations:

• iptables: `iptables -A INPUT -s 106.219.144.202 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 106.219.144.202 drop`
• nginx: `deny 106.219.144.202;`
• pfSense: Block rule for 106.219.144.202/32
• Cloudflare WAF: Block with expression `ip.src eq 106.219.144.202`
• AWS WAF: Add IP 106.219.144.202/32 to block list

Mitigation Priority: Low to Medium. The IP is mobile-carrier derived with no active services. Block at network perimeter or application layer if observed in threat context. Correlate with other abuse signals before enforcement.

---

*Report generated: 2026-07-29*

*Data Source: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.