223.185.61.121📋 Copy

# IP Intelligence Briefing: 223.185.61.121/32

Classification: Moderate Risk | Date: 2026-07-28

Analyst: IPDebrief Intelligence Platform

Scope: Full Profile, History, Relationships, Neighborhood Analysis

---

## Executive Summary

IP address 223.185.61.121 is a residential mobile IP from Bharti Airtel's Indian network infrastructure (ASN 24560). The address presents moderate risk (score: 40) primarily due to two DNSBL listings with high severity. Current network role is "Firewalled / No Services" with no active open ports or services. The IP shows no evidence of persistent malicious activity, known attacker behavior, or spam source designation.

---

## Technical Profile

Service Exposure

• Open Ports: None detected
• TLS Certificate: None
• HTTP Services: None
• Email Infrastructure: None (no SPF/DMARC records)

---

## Threat Intelligence Assessment

Threat Indicators: None detected

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Active Campaigns: None correlated

Control Plane:

• BGP Prefix: 223.185.60.0/23
• Route Stability: Unstable
• DNSSEC Validation: Valid
• RPKI State: Not verified

---

## Historical Analysis

Observation Count: 12 signals tracked

Recent Activity (2026-07-28):

• DNSSEC validation confirmed for PTR zone (121.61.185.223.in-addr.arpa)
• ASN confirmation: 24560 (AIRTELBROADBAND-AS-AP)
• DNSBL activity: 2 listings flagged with high severity
• No ownership changes or threat persistence observed
• No malicious activity detected over observation period

Temporal Indicators:

• Threat Persistence: 0 days
• Ownership Changes: 0
• Persistently Malicious: No

---

## Relationship Graph

Connected Entities: 1

• Network: MOHALI-UN (Same Network relationship)

---

## Neighborhood Analysis

Subnet: 223.185.61.121/24

Total Siblings: 13 IPs

Abuse Density: 0 (Low)

Neighbor Risk Distribution:

• Low Risk: 11 IPs
• Medium Risk: 0 IPs
• High Risk: 0 IPs

Notable Neighbors:

• 223.185.61.18, .19, .51, .61, .73, .138, .161: Risk Score 25 (Medium-Low)
• 223.185.61.0, .74, .87, .183, .205: Risk Score 0
• 223.185.61.86: No risk score available

The subnet shows minimal abuse activity, with the subject IP's risk profile driven primarily by DNSBL listings rather than neighborhood contamination.

---

## Recommendations

Immediate Actions:

1. DNSBL Monitoring: Investigate the 2 DNSBL listings for context (spam, malware, or false positive)

2. Traffic Analysis: Monitor for outbound connections from this mobile IP

3. Geo-Validation: Current geolocation validation shows as implausible—verify with additional sources

Firewall Rules (Recommended):

```bash

# Block DNSBL listings (adjust based on actual lists)

iptables -A INPUT -d 223.185.61.121 -j DROP

# OR allow with logging for investigation

iptables -A INPUT -d 223.185.61.121 -j LOG --log-prefix "IP-223.185.61.121-"

```

Long-Term Considerations:

• Residential mobile IPs may generate false positives in spam filters
• No immediate threat mitigation required beyond standard monitoring
• Review DNSBL listings to determine if blocking is necessary

---

Status: Monitor | Confidence: High | Action Required: Low

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.