125.21.77.2📋 Copy

# IP Intelligence Briefing: 125.21.77.2/32

Date: 2026-06-26

Classification: High Risk (Score: 70/100)

Report Type: Initial Assessment

---

## Executive Summary

IP address 125.21.77.2 is classified as a mobile network address assigned to Airtel (Bharti Airtel Ltd.) in India. The IP exhibits a high risk profile (70/100) with four DNSBL listings and zero open services. No active threat campaigns or known attacker indicators are associated with this address. The immediate /24 subnet (125.21.77.0/24) demonstrates clean abuse density with no neighboring malicious IPs.

---

## Technical Profile

Ownership & Assignment

• ASN: 9498 (IRT-BHARTI-IN)
• Organization: Bharti Airtel Ltd.
• Country: India (IN)
• Mobile Carrier: Airtel (MCC: 404, MNC: 10)
• Connection Type: LTE/5G Mobile Network

Network Classification

• Status: Firewalled / No Services
• Open Ports: None detected
• Services: None exposed
• Infrastructure Type: Mobile Carrier Assignment

---

## Threat Indicators

Risk Assessment

• Reputation: High Risk
• Risk Score: 70/100
• Abuse Confidence Score: Not calculated
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No

Blacklist Status

• DNSBL Listed: 4 out of 8 total lists
• Blacklist Count: 0 (public reputation databases)
• Control Plane DNSBL: 4 listings detected
• Max Severity: High

Campaign Indicators

• Campaign Likelihood: None
• Cert Matches: 0
• Correlated IPs: 0

---

## Historical Observations

Timeline: 16 observations recorded

Recent Activity:

• 2026-06-25 22:06:45: DNSBL listing signal detected (8 total lists, 2 listed, max severity: high)
• 2026-06-25 22:06:44: DNSSEC validation confirmed for zone 2.77.21.125.in-addr.arpa
• 2026-06-25 22:06:55: Operator score signals (0.1304, label: Minimal)
• 2026-06-05: No campaign banner matches observed

Trend Analysis: Evidence suggests intermittent DNSBL association rather than persistent malicious activity. No sustained threat campaign indicators detected.

---

## Neighborhood Analysis

Subnet: 125.21.77.0/24

• Abuse Density: 0% (Clean)
• Classification: Clean
• Total Siblings: 1
• Active Threat Siblings: 0
• High/Medium Risk Neighbors: None

No neighboring IPs within the /24 subnet show malicious indicators, suggesting isolated activity.

---

## Recommended Actions

Monitoring:

• Increase logging verbosity and review recent activity from this IP
• Severity: High (due to risk score 70/100)

Blocking Rules (Recommended):

---

## Risk Assessment Summary

This IP address presents a moderate-to-high risk profile primarily due to its association with four DNSBL listings and elevated risk scoring. The mobile carrier classification suggests the IP may originate from mobile device traffic. The lack of open services and clean neighborhood context reduces the likelihood of active infrastructure compromise. Recommended action is blocking with enhanced monitoring, particularly if this IP begins generating inbound connection attempts.

Assessment Confidence: Medium (based on limited service exposure and mobile classification)

Priority: Monitor and Block

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.