163.61.38.135📋 Copy

# Intelligence Briefing: 163.61.38.135/32

Classification: Moderate Risk

Date: June 17, 2026

Analyst: IPDebrief Intelligence Platform

---

## Executive Summary

IP address 163.61.38.135 presents a moderate risk profile (Risk Score: 40/100) with no active threat indicators. The IP is associated with CHANDER PARKASH organization, registered under the JOYSVC network block within APNIC RIR. Geolocation analysis places the address in Noida, Uttar Pradesh, India. Despite the moderate risk classification, the IP shows no evidence of active malicious behavior, spam generation, or known campaign participation.

## Ownership and Geolocation

Geolocation confidence stands at 52% with an accuracy radius of 1,500 km. Multiple source signals confirmed geo-plausibility.

## Threat Assessment

Active Indicators

• Abuse Confidence Score: Not available
• Blacklist Count: 0
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Known Campaigns: None

Control Plane Analysis

• BGP Prefix: 163.61.38.0/23
• Route Stability: False
• DNSSEC Validation: Valid
• DNSBL Listings: 2 of 8 total lists
• Operator Score: 0.1304 (Minimal)

## Network Fingerprint

• HTTP Server: nginx/1.24.0
• HTTP Status: 200 OK
• HSTS Enabled: Yes
• HTTP/2 Support: No
• TLS Certificate: None observed
• TTFB: 1,205ms
• Services: No open ports detected (Firewalled / No Services)

## Neighborhood Analysis

Subnet: 163.61.38.0/24

Abuse Density: 0%

Classification: Clean

Notable Neighbor: 163.61.38.142 (Risk Score: 25)

## Relationship Graph

The IP demonstrates network-level relationships exclusively within the JOYSVC network block (163.61.38.0/24). No external organization, hostname, or certificate relationships were identified.

## Historical Observations

The IP has generated 20 observations over the monitoring period:

• Threat Persistence: 0 days
• Ownership Changes: 0
• Observation Count: 1
• Persistently Malicious: No

Recent signals indicate minimal activity with no escalation in risk profile.

## Recommended Actions

Given the moderate risk score (40) and lack of confirmed malicious indicators, the following firewall rules are recommended:

```bash

# iptables

iptables -A INPUT -s 163.61.38.135 -j DROP

# nftables

nft add rule inet filter input ip saddr 163.61.38.135 drop

# nginx

deny 163.61.38.135;

# pfSense

163.61.38.135/32

# Cloudflare WAF

{

"description": "Block 163.61.38.135 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 163.61.38.135"

}

}

# AWS WAF

{

"Addresses": ["163.61.38.135/32"],

"Description": "IPDebrief risk 40"

}

```

Note: These recommendations are probabilistic and should be combined with other signals before implementing blocking measures.

## Conclusion

IP 163.61.38.135 is classified as moderate risk but currently demonstrates no active threat behavior. The absence of open services, combined with clean neighborhood metrics and no blacklist presence, suggests this IP may be a legitimate infrastructure endpoint with firewall protections in place. SOC analysts should monitor for any changes in service availability or threat indicator emergence while considering the recommended blocking rules as a precautionary measure.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.