202.62.88.25📋 Copy

# IP Intelligence Briefing: 202.62.88.25

## Executive Summary

IP address 202.62.88.25 presents a high-risk threat profile with a risk score of 80. The IP is located in Bengaluru, Karnataka, India (ASN 17483, org: KRISHNAMOHAN RAMINENI/CITYONLINE-IN) and exhibits DNS blacklist activity across 8 lists with 4 high-severity listings. The address is currently firewalled with no accessible services.

## Risk Assessment

• Overall Risk Score: 80 (High Risk)
• Abuse Confidence: Evidence of DNS blacklist listings (4/8 total lists)
• Network Classification: Firewalled / No Services
• Subnet Abuse Density: 0.5 (50% of /24 flagged)
• Control Plane: Route stability flagged as false; 4 DNSBL listings detected

## Technical Profile

• ASN: 17483 (APNIC RIR)
• Organization: KRISHNAMOHAN RAMINENI
• Network Name: CITYONLINE-IN
• CIDR Block: 202.62.88.0/24
• Geolocation: India, Karnataka, Bengaluru (52% confidence)
• Network Role: Not classified as CDN, Cloud, VPN, Proxy, or Hosting
• Services: No open ports detected; service banner unavailable

## Threat Indicators

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• DNSBL Listings: 4 high-severity entries across 8 total lists
• Traceroute: 21 hops; 2 timeouts observed
• Behavioral Signals: No honeypot hits or WAF violations recorded

## Observation History

Fifteen signal observations recorded with the most recent activity dated 2026-06-13:

• DNSSEC validation: Valid
• Subnet abuse density observed at 0.5
• Country inference: India (52% confidence)
• No persistent malicious activity detected over observation window

## Relationship Analysis

Eight relationships identified, all categorized as "Same Network" and pointing to CITYONLINE-IN. No external hostname, organization, or certificate associations detected.

## Neighborhood Context

Subnet 202.62.88.0/24 contains one additional IP neighbor:

• 202.62.88.27: Risk score 55, Authority score 50 (Medium risk)
• Risk Distribution: 1 medium-risk neighbor, 0 high-risk, 0 low-risk
• Active Siblings: 0 currently active threat indicators

## Recommended Actions

The following firewall rules are recommended for defensive deployment:

```bash

# iptables/nftables

iptables -A INPUT -s 202.62.88.25 -j DROP

iptables -A INPUT -s 202.62.88.27 -j DROP

# Cloudflare WAF

# Add 202.62.88.25/32 to Block list

# AWS WAF

# Create IPSet for 202.62.88.25 with action block

```

## Conclusion

IP 202.62.88.25 requires defensive blocking due to multiple DNS blacklist listings and high-risk classification. The subnet exhibits moderate abuse density, with one additional medium-risk neighbor. No active threat indicators or known campaigns associated. Recommend monitoring the broader 202.62.88.0/24 subnet for emerging malicious activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.