# 223.185.63.252 — IP Intelligence Summary

223.185.63.252 is an IPv4 address operated by IRT-BHARTI-MO-IN (AS24560), geolocated to Ranchi, India. It belongs to a mobile network. As of September 2, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/223.185.63.252
- Last updated: 2026-09-02

## Ownership

- Organization: IRT-BHARTI-MO-IN
- Network name: MOHALI-UN
- Allocated block: 223.185.60.0/22
- ASN: AS24560 (https://ipdebrief.com/asn/24560)
- Regional registry: APNIC

## Location

- City: Ranchi
- Region: Jharkhand
- Country: India
- Time zone: —

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: yes
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (40/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP Intelligence Briefing: 223.185.63.252/32

\## Executive Summary

IP 223.185.63.252 presents a **LOW RISK** profile (Risk Score: 15) with no active threat indicators. The address is classified as mobile infrastructure operated by Bharti Airtel (ASN 24560) within the MOHALI-UN network block (223.185.60.0/22) in Ranchi, Jharkhand, India. No malicious activity or campaign correlations were observed.

\## Technical Profile

**Ownership & Classification:**

\- ASN: 24560 (IRT-BHARTI-MO-IN)

\- Organization: MOHALI-UN

\- Network Block: 223.185.60.0/22

\- Service Purpose: Firewalled / No Services

\- Network Role: Mobile (Airtel carrier, LTE/5G technology)

**Geolocation:**

\- Country: India (IN)

\- Region: Jharkhand

\- City: Ranchi

\- Confidence: Geo-plausible with 1500km accuracy radius

**Network Services:**

\- Open Ports: None detected

\- DNS Resolution: No forward resolution

\- TLS Certificates: None

\- HTTP Services: None

**Threat Indicators:**

\- Abuse Confidence Score: N/A

\- Blacklist Status: 0 blacklists

\- DNSBL Listed: 1 of 8 threat lists

\- Known Attacker: No

\- Tor Exit Node: No

\- Spam Source: No

\## Observation History

**Temporal Analysis:**

\- Total Observations: 17 signals

\- Threat Persistence Days: 0

\- Ownership Changes: 0

\- Persistently Malicious: No

**Recent Signals (2026-07-28):**

\- Traceroute: 29 hops observed with 15 timeouts; target reached

\- Geolocation: Validated with ICMP blocks during probing

\- Network Classification: Consistent mobile classification

\- No banner matches or campaign correlations detected

\## Neighborhood Assessment

**Subnet Analysis (223.185.63.0/24):**

\- Abuse Density: 0

\- Total Siblings: 7

\- Active Siblings: 0

\- Threat Siblings: 0

**Neighbor Risk Distribution:**

\- High Risk: 0

\- Medium Risk: 2 (223.185.63.58, 223.185.63.125 at Risk Score 40)

\- Low Risk: 5

Notable elevated-risk neighbors include 223.185.63.58 and 223.185.63.125 (Risk Score 40), but the target IP shows no correlation with these addresses.

\## Relationships

\- **Network Associations:** MOHALI-UN (Same Network)

\- No associated hostnames, certificates, or organizational entities detected

\- No correlated IP addresses in campaign analysis

\## Control Plane Intelligence

\- BGP Prefix: 223.185.62.0/23

\- Route Stability: Unstable

\- RIR: APNIC

\- DNSSEC: Valid

\- Route Changes (30d): 0

\## Recommended Actions

**Classification:** LOW RISK - No immediate blocking required

**Firewall Policy:**

\- Monitor for service changes (currently no open ports)

\- No blocking recommended

\- Standard monitoring applies for mobile carrier infrastructure

**Threat Intelligence:**

\- No threat feed matches

\- No campaign associations

\- No active abuse indicators

\## SOC Analyst Notes

This IP is classified as mobile carrier infrastructure (Airtel). The risk score of 15 is consistent with legitimate mobile network addresses. The single DNSBL listing likely represents a false positive or routine monitoring artifact. No evidence of malicious activity, command-and-control, or attack infrastructure. The IP should be treated as benign infrastructure requiring standard monitoring.

## Nearby addresses

- 223.185.63.13 (https://ipdebrief.com/223.185.63.13)
- 223.185.63.15 (https://ipdebrief.com/223.185.63.15)
- 223.185.63.16 (https://ipdebrief.com/223.185.63.16)
- 223.185.63.22 (https://ipdebrief.com/223.185.63.22)
- 223.185.63.26 (https://ipdebrief.com/223.185.63.26)
- 223.185.63.58 (https://ipdebrief.com/223.185.63.58)
- 223.185.63.94 (https://ipdebrief.com/223.185.63.94)
- 223.185.63.107 (https://ipdebrief.com/223.185.63.107)
- 223.185.63.116 (https://ipdebrief.com/223.185.63.116)
- 223.185.63.125 (https://ipdebrief.com/223.185.63.125)
- 223.185.63.127 (https://ipdebrief.com/223.185.63.127)
- 223.185.63.155 (https://ipdebrief.com/223.185.63.155)

---

Source: IPDebrief, "223.185.63.252 IP intelligence", https://ipdebrief.com/223.185.63.252, updated 2026-09-02. Assessments are probabilistic.