27.123.98.22📋 Copy

IP Intelligence Briefing: 27.123.98.22

Date: 2026-06-08

---

**1. Risk Profile**

• Overall Risk Score: High (80/100)
• Network Classification: Mobile (LTE/5G) under Bharti Airtel Limited (AS9498)
• Geolocation: India (Haryana, Gurugram)
• Threat Indicators: No direct malicious activity detected (no known campaigns, spam, or attacker listings).
• Neighborhood Risk: Subnet 27.123.98.0/24 has 66.7% abuse density, with 2 high-risk neighbors (80/100 score) and 1 medium-risk neighbor (70/100 score).

---

**2. Network & Ownership**

• ISP: Bharti Airtel Limited (AS9498, APNIC)
• Mobile Carrier: Airtel (MCC 404, MNC 10, LTE/5G)
• Subnet: 27.123.98.0/24 (abuse density: 66.7%, classification: "mostly_clean")
• DNSSEC: Validated
• DNSBL Listings: 5/8 lists (potential abuse risk, though not confirmed malicious activity).

---

**3. Observation History**

• Recent Activity (2026-06-03 to 2026-06-08):

- Minimal operator risk (0.13 score).

- DNSSEC validation and routing stability observed.

- No persistent malicious behavior (threat persistence: 0 days).

- DNSBL listings detected (5/8 lists), suggesting possible abuse.

---

**4. Relationships & Context**

• Network Affiliation: Linked to BHARTI-IN (Bharti Airtel’s network identifier).
• Subnet Neighbors:

- 27.123.98.6 (80/100 risk)

- 27.123.98.26 (80/100 risk)

- 27.123.98.102 (70/100 risk)

• No Tor/VPN/Proxy Activity: Identified as a mobile network (not anonymized).

---

**5. Recommendations**

• Monitor Subnet: High abuse density in 27.123.98.0/24 warrants closer scrutiny for lateral movement or shared infrastructure risks.
• Verify DNSBL Listings: Investigate why 5/8 DNSBLs flag this subnet (potential misconfigurations or shared hosting risks).
• Check Mobile Network Policies: Airtel’s LTE/5G network may have broader security controls to mitigate neighbor risks.
• Baseline for Anomalies: Track traffic patterns for deviations from the mobile network’s typical behavior.

---

Note: No direct malicious activity detected, but the IP’s neighborhood and DNSBL associations suggest indirect risk. SOC teams should prioritize subnet-level monitoring and collaboration with the ISP for deeper insights.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.