152.52.199.18📋 Copy

# IP Intelligence Briefing: 152.52.199.18/32

## Executive Summary

IP address 152.52.199.18 is classified as HIGH RISK (risk score 80/100) and is associated with Indian mobile carrier Bharti Airtel. The address shows elevated threat indicators with DNSBL listings across 6 of 8 monitored blacklists. Immediate defensive action is recommended.

## Technical Profile

Network Ownership:

• ASN: 9498 (IRT-BHARTI-IN)
• Organization: Bharti Infratel
• RIR: ARIN
• CIDR Block: 152.52.199.0/24

Geolocation & Mobility:

• Country: India (IN)
• Mobile Carrier: Airtel/Bharti Airtel Ltd. (MCC: 404, MNC: 10)
• Connection Technology: LTE/5G
• Geographic Accuracy: ±1,500 km (mobile inference)

Network Classification:

• Infrastructure Type: Mobile
• Services: Firewalled/No Services Detected
• Proxy/VPN/Tor: Negative indicators
• Anycast: No

## Threat Indicators

Risk Assessment:

• Overall Risk Score: 80/100 (High Risk)
• DNSBL Listings: 6/8 blacklists
• Abuse Confidence: Listed across multiple threat feeds
• Control Plane Operator Score: 0.1304 (Minimal)

Threat Indicators:

• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Known Campaigns: None identified

## Observational History

Analysis of 19 historical observations reveals:

• Most Recent: 2026-06-22
• Threat Observation Count: 1
• Persistent Malicious Activity: No
• Ownership Changes: 0

The IP has shown minimal operator scoring across historical signals with no evidence of sustained malicious behavior patterns.

## Network Neighborhood Analysis

Subnet 152.52.199.0/24 assessment:

• Abuse Density: 0 (clean subnet classification)
• Total Siblings: 2
• Active Threat Siblings: 0
• Neighbor IP (152.52.199.110): Risk Score 40/100 (Medium)

## Related Entities

13 relationship entries identified, all associated with "BHARTI-IN" network infrastructure.

## Recommended Actions

Immediate Actions (Critical Severity):

1. Increase logging verbosity and review recent activity from this IP

2. Implement firewall blocking per the following rules:

- iptables: `iptables -A INPUT -s 152.52.199.18 -j DROP`

- nftables: `nft add rule inet filter input ip saddr 152.52.199.18 drop`

- nginx: `deny 152.52.199.18;`

- pfSense: `152.52.199.18/32`

- Cloudflare WAF: Block rule with expression `ip.src eq 152.52.199.18`

- AWS WAF: Address `152.52.199.18/32` with description "IPDebrief risk 80"

## Analyst Notes

Despite being a mobile IP address with no open services detected, the high risk score (80/100) and multiple DNSBL listings warrant defensive blocking. The single medium-risk neighbor (152.52.199.110) suggests potential lateral movement within the mobile network. Monitor for any service activation or behavioral changes from this address.

---

*Report generated: IPDebrief Intelligence Platform*

*Classification: Defensive Security Intelligence*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.