122.187.228.231📋 Copy

# IP Intelligence Briefing: 122.187.228.231/32

## Executive Summary

IP address 122.187.228.231 presents a High Risk profile with an overall risk score of 80/100. The endpoint is classified as a single-service mobile host operating on the Airtel (Bharti Airtel Ltd.) mobile network in Maharashtra, India. The IP appears on 6 out of 8 DNSBL listings and exhibits elevated abuse activity within its /24 subnet.

## Technical Profile

## Threat Indicators

• DNSBL Listings: 6 out of 8 total lists (evidence of prior abuse)
• Subnet Abuse Density: 0.4 (moderate elevation)
• Blacklist Presence: Active across multiple threat intelligence feeds
• Mobile Classification: Single-service host on mobile network infrastructure
• No Campaign Association: No correlated threat campaigns identified

## Neighborhood Analysis

The /24 subnet (122.187.228.0/24) contains 5 sibling IPs with the following risk distribution:

• High Risk: 1 IP (122.187.228.253, score: 80)
• Medium Risk: 3 IPs (scores: 55-70)
• Subnet Classification: Mostly clean
• Abuse Density: 0.25

Notable neighboring IPs include 122.187.228.233 (risk 70) and 122.187.228.228 (risk 55), indicating concentrated risk within this mobile carrier subnet.

## Observation History

• Total Observations: 27 signals across the monitoring period
• Recent Activity: Most recent signals observed on 2026-06-22
• Blacklist Activity: 4 listings with "high" severity detected
• Persistence: No persistent malicious behavior detected (threat_persistence_days: 0)
• Ownership Stability: No ownership changes recorded

## Recommended Actions

Immediate Mitigation

1. Block Traffic: Implement firewall rules to drop traffic from 122.187.228.231

2. Enhanced Logging: Increase logging verbosity to capture any attempted connections

3. Monitor Subnet: Monitor adjacent IPs in 122.187.228.0/24, particularly 122.187.228.253 (risk 80)

Platform-Specific Rules

```

iptables: iptables -A INPUT -s 122.187.228.231 -j DROP

nftables: nft add rule inet filter input ip saddr 122.187.228.231 drop

Cloudflare WAF: Block IP with expression "ip.src eq 122.187.228.231"

AWS WAF: Add CIDR block 122.187.228.231/32 to block list

```

## Risk Assessment

This IP represents a medium-to-high priority threat due to:

• Elevated risk score (80/100)
• Multiple DNSBL listings indicating prior abuse
• Mobile network origin with SSH service exposed
• Concentrated risk within the /24 subnet

Recommended Severity: Critical (monitor and consider blocking)

Classification: Mobile Network Abuse Indicator

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.