117.217.212.252📋 Copy

# IP Intelligence Briefing: 117.217.212.252

## Executive Summary

IP address 117.217.212.252 presents a MODERATE RISK profile (Risk Score: 40) associated with BSNL's broadband infrastructure network in India. The IP is classified as "Firewalled / No Services" with no active open ports or running services detected.

## Ownership and Network Context

• Organization: IRT-BSNL-IN (BB-Multiplay-General)
• ASN: 9829
• Network Block: 117.216.0.0/15
• Geolocation: India (IN), Kerala region, Kara city area
• Registration: APNIC RIR registry

## Risk Assessment

• Overall Risk Score: 40/100 (Moderate)
• DNSBL Listings: 2 out of 8 total lists (dnsblListedCount: 2)
• Abuse Density: Subnet classified as "mostly_clean" with minimal inherited risk
• Network Classification: Provider infrastructure, no CDN/Cloud/VPN/proxy indicators

## Threat Indicators

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Matches: None detected (certMatches: 0, bannerMatches: 0)
• Blacklist Count: 0 (threat section)
• Threat Persistence: Not persistently malicious

## Service Footprint

• Open Ports: None detected
• TLS Certificate: None
• HTTP Response: None
• DNS Resolution: No forward resolution confirmed
• Hosted Domains: 0

## Historical Observations

Analysis of 17 signal observations indicates:

• Threat observation count: 1
• No persistent malicious behavior detected
• Recent activity (as of 2026-06-17) shows standard broadband network classification
• Geographic data: Inferred location in India with 1500km accuracy radius

## Neighborhood Analysis

• Subnet: 117.217.212.0/24
• Abuse Density: 0
• Active Siblings: 1
• Threat Siblings: 1
• Risk Distribution: Low risk profile for neighboring IPs

## Recommended Actions

Based on the risk profile, the following mitigation controls are recommended:

Firewall Rules:

• iptables: `iptables -A INPUT -s 117.217.212.252 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 117.217.212.252 drop`
• nginx: `deny 117.217.212.252;`
• pfSense: `117.217.212.252/32`

Cloud WAF:

• Cloudflare WAF: Block with expression `ip.src eq 117.217.212.252`
• AWS WAF: Add 117.217.212.252/32 to blocklist

## Analyst Notes

This IP belongs to BSNL's broadband multiplay infrastructure and shows moderate risk indicators primarily from DNSBL listings. While no active services or open ports are detected, the presence on multiple blacklist feeds warrants defensive blocking. The subnet shows low abuse density, suggesting this may be an isolated reputation issue rather than coordinated malicious activity.

Priority: MEDIUM - Implement blocking rules and monitor for pattern changes.

---

*Report generated: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.