# 122.187.230.11 — IP Intelligence Summary

122.187.230.11 is an IPv4 address operated by IRT-BHARTI-IN (AS9498), geolocated to Navsāri, India. It belongs to a mobile network with reverse DNS name nsg-corporate-11.230.187.122.airtel.in. As of October 25, 2026, IPDebrief rates it High Risk (80/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/122.187.230.11
- Last updated: 2026-10-25

## Ownership

- Organization: IRT-BHARTI-IN
- Network name: BNLD-209392-NewDelhi
- Allocated block: 122.187.0.0/16
- ASN: AS9498 (https://ipdebrief.com/asn/9498)
- Regional registry: APNIC

## Location

- City: Navsāri
- Region: Maharashtra
- Country: India
- Time zone: Asia/Kolkata

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: yes
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: High Risk (80/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- nsg-corporate-11.230.187.122.airtel.in
- Forward-confirmed: no

## Exposed services

- 443/tcp — https
- 22/tcp — ssh

## Analyst narrative

\# IP Intelligence Briefing: 122.187.230.11

\## Executive Summary

IP address 122.187.230.11 is classified as **High Risk** with a risk score of 80/100. The address is associated with Bharti Airtel infrastructure in New Delhi, India, operating as a mobile web server. Despite corporate naming conventions, the IP exhibits significant abuse indicators including multiple DNSBL listings and an elevated threat profile within its /24 subnet.

\## Technical Profile

| Attribute | Value |

|-----------|-------|

| **ASN** | 9498 (IRT-BHARTI-IN) |

| **Organization** | BNLD-209392-NewDelhi |

| **Location** | Phase III, New Delhi, India (IN) |

| **Network Type** | Mobile/Residential Gateway |

| **Open Ports** | 443/TCP (HTTPS), 22/TCP (SSH) |

| **Server Software** | lighttpd/1.4.45 |

| **Reverse DNS** | nsg-corporate-11.230.187.122.airtel.in |

| **TLS Certificate** | Self-signed (localhost) |

\## Threat Intelligence

**Risk Indicators:**

\- Risk Score: 80/100 (High Risk)

\- DNSBL Listed: 6 of 8 total lists

\- Operator Score: Minimal (0.1304)

\- No confirmed malicious campaigns or known attacker attribution

\- No Tor exit node or proxy indicators

**Network Context:**

The /24 subnet 122.187.230.0/24 demonstrates a **66.7% abuse density** with 42 neighboring IPs analyzed. Risk distribution shows 28 high-risk neighbors, 9 medium-risk, and 4 low-risk. Multiple adjacent IPs (122.187.230.12, .13, .20, .38, .41, .66) share the same risk score of 80, suggesting systematic abuse or compromised infrastructure within this block.

\## Historical Observations

17 signal observations recorded. Recent activity (July 22, 2026) includes:

\- TLS certificate scanning (TLS 1.2, AES-256-GCM)

\- Port scanning activity

\- Geolocation inference (India, 20.59°N, 78.96°E)

\- No persistent malicious behavior observed (0 threat persistence days)

\## Recommended Actions

**Immediate Mitigation:**

\`\`\`bash

\# iptables

iptables -A INPUT -s 122.187.230.11 -j DROP

\# nftables

nft add rule inet filter input ip saddr 122.187.230.11 drop

\# Cloudflare WAF

{"action":"block","filter":{"expression":"ip.src eq 122.187.230.11"}}

\# AWS WAF

{"Addresses":\["122.187.230.11/32"\], "Description":"IPDebrief risk 80"}

\`\`\`

**Additional Recommendations:**

1. Increase logging verbosity for traffic from this IP and the entire /24 subnet

2. Review SSH (port 22) access patterns — corporate naming conventions suggest this may be a managed service endpoint

3. Monitor for lateral movement to related hostnames: nsg-corporate-11.230.187.122.airtel.in

4. Consider blocking the entire 122.187.230.0/24 subnet given the 66.7% abuse density

\## Analyst Notes

The IP's corporate DNS naming (nsg-corporate-11) conflicts with its high-risk classification and mobile carrier association. This discrepancy suggests either compromised infrastructure, misconfigured services, or a legitimate service being abused. The concentration of high-risk IPs within the /24 subnet warrants broader investigation into the underlying network infrastructure.

\---

*Report generated: IPDebrief Intelligence Platform*

## Nearby addresses

- 122.187.230.12 (https://ipdebrief.com/122.187.230.12)
- 122.187.230.13 (https://ipdebrief.com/122.187.230.13)
- 122.187.230.20 (https://ipdebrief.com/122.187.230.20)
- 122.187.230.34 (https://ipdebrief.com/122.187.230.34)
- 122.187.230.38 (https://ipdebrief.com/122.187.230.38)
- 122.187.230.41 (https://ipdebrief.com/122.187.230.41)
- 122.187.230.66 (https://ipdebrief.com/122.187.230.66)
- 122.187.230.68 (https://ipdebrief.com/122.187.230.68)
- 122.187.230.73 (https://ipdebrief.com/122.187.230.73)
- 122.187.230.81 (https://ipdebrief.com/122.187.230.81)
- 122.187.230.82 (https://ipdebrief.com/122.187.230.82)
- 122.187.230.83 (https://ipdebrief.com/122.187.230.83)

---

Source: IPDebrief, "122.187.230.11 IP intelligence", https://ipdebrief.com/122.187.230.11, updated 2026-10-25. Assessments are probabilistic.