223.233.87.114📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 223.233.87.114/32

Classification: Mobile Residential – Airtel Broadband

Date: Current Assessment

## Executive Summary

The IP address 223.233.87.114 was classified as moderate risk (Score: 40) during the assessment. The address operates as a mobile broadband endpoint on India's Airtel LTE/5G network infrastructure in Pune, Maharashtra. No active threat indicators were identified, though the IP exhibited DNSBL listings on two of eight monitored blacklists.

## Infrastructure Profile

The IP belongs to ABTS-DSL-DEL (AS24560), a residential broadband subnet allocated under the APNIC RIR. The address is assigned to Airtel (Bharti Airtel Ltd., MCC:404, MNC:10) and operates within the 223.233.64.0/18 CIDR block. Reverse DNS resolution returned the hostname abts-north-dynamic-114.87.233.223.airtelbroadband.in, confirming mobile carrier allocation. No services were observed on open ports, and the endpoint was classified as "Firewalled / No Services."

## Threat Indicators

Threat assessment returned negative results across all monitored feeds:

• Abuse Confidence Score: Not calculated
• Blacklist Count: 0 (general lists)
• Tor Exit: No
• Known Attacker: No
• Spam Source: No
• Campaign Association: None detected

Control plane analysis revealed minor DNSBL presence (2 of 8 lists), though the operator score remained minimal at 0.1304.

## Neighborhood Analysis

The /24 subnet (223.233.87.0/24) demonstrated low abuse density (Score: 0) with a "clean" classification. Risk distribution across 8 sibling IPs showed:

• High Risk: 0
• Medium Risk: 2 (223.233.87.179, 223.233.87.224)
• Low Risk: 4
• Inactive: 2

Notable neighbors included 223.233.87.224 (Risk: 55) and 223.233.87.179 (Risk: 40), both sharing the same authority score of 50.

## Historical Observation

Analysis of 19 observations revealed consistent mobile broadband characteristics with no escalation in risk posture. Ownership remained stable with zero ownership changes and no persistent malicious activity detected. The most recent observation (2026-07-30) confirmed the subnet maintained a "clean" classification with inherited risk of 0.

## Relationship Graph

Nine relationships were identified, including multiple same-network associations to ABTS-DSL-DEL and DNS associations to the carrier-resolved hostname. No interconnections to known malicious infrastructure were detected.

## Recommended Actions

Based on risk score 40 and mobile broadband classification, the following mitigations are recommended:

## Conclusion

The IP address represents a standard residential mobile broadband endpoint with no active malicious indicators. While the risk score of 40 suggests moderate concern, the absence of threat indicators, blacklisting, and persistent malicious activity supports classification as legitimate residential traffic. SOC teams may monitor for policy-based violations but need not treat as active threat.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.