122.187.230.11📋 Copy

# IP Intelligence Briefing: 122.187.230.11

## Executive Summary

IP address 122.187.230.11 is classified as High Risk with a risk score of 80/100. The address is associated with Bharti Airtel infrastructure in New Delhi, India, operating as a mobile web server. Despite corporate naming conventions, the IP exhibits significant abuse indicators including multiple DNSBL listings and an elevated threat profile within its /24 subnet.

## Technical Profile

## Threat Intelligence

Risk Indicators:

• Risk Score: 80/100 (High Risk)
• DNSBL Listed: 6 of 8 total lists
• Operator Score: Minimal (0.1304)
• No confirmed malicious campaigns or known attacker attribution
• No Tor exit node or proxy indicators

Network Context:

The /24 subnet 122.187.230.0/24 demonstrates a 66.7% abuse density with 42 neighboring IPs analyzed. Risk distribution shows 28 high-risk neighbors, 9 medium-risk, and 4 low-risk. Multiple adjacent IPs (122.187.230.12, .13, .20, .38, .41, .66) share the same risk score of 80, suggesting systematic abuse or compromised infrastructure within this block.

## Historical Observations

17 signal observations recorded. Recent activity (July 22, 2026) includes:

• TLS certificate scanning (TLS 1.2, AES-256-GCM)
• Port scanning activity
• Geolocation inference (India, 20.59°N, 78.96°E)
• No persistent malicious behavior observed (0 threat persistence days)

## Recommended Actions

Immediate Mitigation:

```bash

# iptables

iptables -A INPUT -s 122.187.230.11 -j DROP

# nftables

nft add rule inet filter input ip saddr 122.187.230.11 drop

# Cloudflare WAF

{"action":"block","filter":{"expression":"ip.src eq 122.187.230.11"}}

# AWS WAF

{"Addresses":["122.187.230.11/32"], "Description":"IPDebrief risk 80"}

```

Additional Recommendations:

1. Increase logging verbosity for traffic from this IP and the entire /24 subnet

2. Review SSH (port 22) access patterns — corporate naming conventions suggest this may be a managed service endpoint

3. Monitor for lateral movement to related hostnames: nsg-corporate-11.230.187.122.airtel.in

4. Consider blocking the entire 122.187.230.0/24 subnet given the 66.7% abuse density

## Analyst Notes

The IP's corporate DNS naming (nsg-corporate-11) conflicts with its high-risk classification and mobile carrier association. This discrepancy suggests either compromised infrastructure, misconfigured services, or a legitimate service being abused. The concentration of high-risk IPs within the /24 subnet warrants broader investigation into the underlying network infrastructure.

---

*Report generated: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.