122.187.249.198📋 Copy

# IP INTELLIGENCE BRIEFING: 122.187.249.198/32

Classification: Moderate Risk — Mobile Infrastructure with Elevation Signals

Date: Current

Status: Active Monitoring Recommended

---

## EXECUTIVE SUMMARY

IP address 122.187.249.198 is assigned to Airtel (Bharti Airtel Ltd.), a major Indian telecommunications carrier. The IP is classified as mobile infrastructure with a risk score of 65/100. While the IP itself shows no active services and is firewalled, neighborhood analysis reveals elevated risk in the /24 subnet (abuse density 50%), with one sibling IP (122.187.249.88) scoring 80/100. The IP appears in 3 of 8 DNSBL listings, indicating historical abuse association.

---

## TECHNICAL PROFILE

---

## THREAT INDICATORS

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Open Ports: None detected
• TLS/HTTP Services: None
• Certificate Indicators: None

DNS Analysis:

• PTR Record: nsg-corporate-198.249.187.122.airtel.in
• DNSSEC: Valid
• Forward Resolution: 1 hostname

---

## NEIGHBORHOOD ANALYSIS — 122.187.249.0/24

The /24 subnet shows moderate abuse density (0.5/1.0) with mixed classification. One neighbor IP identified:

Subnet Risk Distribution:

• High Risk: 1 IP
• Medium Risk: 0 IPs
• Low Risk: 0 IPs

---

## OBSERVATION HISTORY

Recent signals (June 2026) indicate:

• DNSSEC validation: Confirmed
• Blacklist activity: 3 current listings (max severity: high)
• Ownership stability: No changes
• Threat persistence: 0 days observed

---

## NETWORK RELATIONSHIPS

The IP is associated with network: BNLD-209392-NewDelhi. No direct certificate or hostname relationships identified.

---

## RECOMMENDED ACTIONS

Immediate:

1. Increase logging verbosity for this IP to capture recent activity patterns

2. Block at perimeter firewall (iptables, nftables, or equivalent)

Firewall Rules:

```bash

iptables -A INPUT -s 122.187.249.198 -j DROP

nft add rule inet filter input ip saddr 122.187.249.198 drop

```

Cloud/CDN Protection:

• Cloudflare WAF: Block (expression: `ip.src eq 122.187.249.198`)
• AWS WAF: Add to IP Set with description "IPDebrief risk 65"

---

## ASSESSMENT

This IP represents a mobile carrier address with elevated risk due to neighborhood abuse patterns and DNSBL presence. While the IP itself shows no active malicious services, the associated subnet contains high-risk neighbors. Recommend treating as suspicious for inbound traffic and blocking at network perimeter unless specific business justification exists for allowing traffic from this address.

Confidence: High

Data Sources: IPDebrief Intelligence Platform

Classification: Defensive Security Intelligence

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.