117.222.139.89📋 Copy

# IP Intelligence Briefing: 117.222.139.89

Classification: High Risk

Date of Analysis: 2026-07-30

Analyst: IPDebrief SOC Intelligence Team

---

## Executive Summary

IP address 117.222.139.89 was identified as a high-risk endpoint during automated scanning operations. The address demonstrates a risk score of 80/100, indicating elevated threat potential despite limited observable malicious activity. The IP belongs to BSNL's multi-play broadband infrastructure and is geolocated to Kanchipuram, Tamil Nadu, India.

---

## Ownership and Geolocation

The IP address is registered under ASN 9829 (IRT-BSNL-IN), operating within the BB-Multiplay-General network block (117.222.0.0/16). Geolocation data indicates placement in Kanchipuram, Tamil Nadu (IN), with a consensus accuracy radius of 1500km. Multiple geolocation sources confirm this placement.

Network Classification:

• Infrastructure Type: ISP/Multi-play broadband
• Connection Type: Residential/business broadband
• Cloud/VPN/Proxy: No
• Mobile Carrier: No

---

## Threat Assessment

Current Risk Profile:

• Risk Score: 80 (High)
• Provider Score: 0
• Authority Score: 0
• Operator Score: 0.1304 (Minimal)

Threat Indicators:

• Blacklist Count: 0
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Active Threat Feeds: None detected

Control Plane Analysis:

• DNSBL Listings: 4 of 8 total lists
• Route Stability: Unstable
• RPKI State: Not verified
• IRR Consistency: Not verified

---

## Network Behavior and Services

Service Enumeration:

• Open Ports: None detected
• HTTP/HTTPS: No services detected
• TLS Certificates: None
• Server Banner: No banner detected

The IP appears firewalled with no active services exposed. This configuration suggests either a dormant endpoint, residential connection, or intentionally hardened infrastructure.

---

## Neighborhood Analysis

Subnet: 117.222.139.89/24

• Abuse Density: 0.0
• Classification: Clean
• Active Siblings: 0
• Threat Siblings: 0
• Total Siblings: 1

The /24 subnet demonstrates minimal abuse activity, with no neighboring IPs flagged as threats. This indicates the high-risk score for 117.222.139.89 may stem from historical data, DNSBL listings, or control plane anomalies rather than current malicious activity.

---

## Historical Observations

Fifteen signal observations were recorded, with the most recent activity occurring on 2026-07-30. Historical patterns show:

• Multiple scanning events with moderate confidence levels (0.30-0.85)
• No persistent malicious behavior detected
• No ownership changes recorded
• Threat persistence days: 0

The observation count suggests automated scanning interest rather than sustained adversarial activity.

---

## Relationship Graph

Five relationship entries were identified, all pointing to the parent network "BB-Multiplay-General." No external entity associations (hostnames, organizations, certificates) were discovered.

---

## Recommended Actions

For SOC Analysts:

1. Monitor: The high risk score warrants continued monitoring despite clean neighborhood metrics

2. DNSBL Review: Investigate the 4 DNSBL listings for 117.222.139.89 to understand listing rationale

3. Baseline: Establish baseline behavior given the firewalled/no-service state

4. Correlation: Cross-reference with threat intelligence feeds for BSNL network-wide patterns

Firewall/Blocking Decision:

• Block if: IP appears in active threat feeds or shows malicious behavior
• Monitor if: No confirmed malicious activity; risk score may be legacy
• Allow if: Legitimate inbound traffic confirmed and no threat indicators present

---

## Conclusion

IP 117.222.139.89 presents a high-risk profile primarily driven by DNSBL listings and control plane anomalies rather than active threat indicators. The clean neighborhood classification and lack of observable services suggest this may be a dormant or residential endpoint. Continued monitoring is recommended to track risk score evolution, particularly given the discrepancy between the 80/100 risk score and minimal current threat observations.

Priority: Medium

Action Required: Monitor DNSBL listings and threat feed correlations

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.