117.199.242.253📋 Copy

# IP Intelligence Briefing: 117.199.242.253/32

## Executive Summary

IP address 117.199.242.253/32 is classified as Moderate Risk with an overall risk score of 55/100. The IP is attributed to BSNL (Indian Railways Telecom Network) infrastructure, registered under ASN 9829 (IRT-BSNL-IN), and geolocated to Jamshedpur, Jharkhand, India. While the IP shows no active threat indicators, it has been listed on 2 of 8 DNS blacklists with maximum severity of high in historical observations.

## Technical Profile

## Threat Indicators

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0
• Campaign Likelihood: None
• Persistent Malicious Activity: No
• Threat Observation Count: 1
• Route Stability: False

## Historical Observations

Signal history shows 16 observations with the following key events:

• 2026-06-05 22:04:35: IP was detected on 8 DNS blacklist listings with maximum severity of "high" (confidence 0.85)
• 2026-06-05 22:04:14: Geographic inference placed IP in India (country: IN, coordinates: 20.59, 78.96) with 1500km accuracy radius
• 2026-06-05 22:01:12: ASN resolution confirmed as BSNL-NIB (ASN 9829, prefix 117.199.240.0/20)

## Network Neighborhood Analysis

The /24 subnet (117.199.242.253/24) shows:

• Abuse Density: 1 (low)
• Classification: Mostly clean
• Active Siblings: 1
• Threat Siblings: 1
• Risk Distribution: 0 high, 0 medium, 0 low
• Inherited Risk: 2

## Infrastructure Relationships

Multiple relationship records identify this IP as associated with "BB-Multiplay" network infrastructure. The IP shows no open ports, no TLS certificates, and no HTTP services. Forward DNS resolution is not confirmed, and no PTR hostnames are available.

## Security Recommendations

Based on the risk profile of 55/100, the following actions are recommended:

Immediate Actions

1. Increase logging verbosity and review recent activity from this IP address

2. Block at perimeter firewall given elevated risk score

Recommended Firewall Rules

```bash

# iptables

iptables -A INPUT -s 117.199.242.253 -j DROP

# nftables

nft add rule inet filter input ip saddr 117.199.242.253 drop

# nginx

deny 117.199.242.253;

# pfSense

117.199.242.253/32

# Cloudflare WAF

{"description":"Block 117.199.242.253 — IPDebrief risk score 55","action":"block","filter":{"expression":"ip.src eq 117.199.242.253"}}

# AWS WAF

{"Addresses":["117.199.242.253/32"],"Description":"IPDebrief risk 55"}

```

## Analyst Notes

While the IP does not exhibit active attack patterns or open services, the presence of DNS blacklist listings with high severity warrants monitoring. The route stability flag being false may indicate potential BGP route changes. The IP should be added to threat monitoring feeds for continued observation of any changes in behavior or reputation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.