27.97.108.32📋 Copy

IP INTELLIGENCE BRIEFING: 27.97.108.32

Classification: Mobile Carrier Infrastructure | Risk Level: Moderate (40/100) | Geolocation: India (IN), Madhya Pradesh, Khandwa

Ownership and Network:

The IP address 27.97.108.32 belongs to Vodafone Idea Ltd. (VIL), operating under ASN 45271 (VIL-IN). The address falls within the 27.97.0.0/16 CIDR block registered with APNIC. The IP is classified as a mobile carrier endpoint, with BSNL carrier attribution (MCC: 404, MNC: 72) over LTE technology.

Threat Assessment:

• Overall risk score: 40 (Moderate Risk)
• No known malicious indicators detected
• Zero blacklist entries
• No association with known attacker campaigns
• No Tor exit node activity
• Not classified as spam source
• No open services; connection status: Firewalled / No Services

Technical Profile:

• Infrastructure Type: Mobile Carrier
• DNS: No PTR hostnames, no forward resolution capability
• Services: No open ports detected
• Certificate/SSL: None observed
• HTTP Services: None active

Observation History:

Sixteen observations recorded as of 2026-07-30. Ownership signals consistently attributed to Vodafone Idea Ltd. Geographic resolution shows some inconsistency—while primary geolocation indicates Madhya Pradesh, India, one traceroute observation suggested US infrastructure (New York, Comcast), though target reachability failed. Mobile carrier classification remains stable across observations. No persistent malicious activity detected.

Geographic and Network Context:

• Control plane: Route origin ASN 45271, BGP prefix 27.97.108.0/24
• Route stability: False
• DNSBL listings: 2 of 8 total lists
• Subnet (27.97.108.0/24): Abuse density 0%, classified as "clean"
• Neighbor analysis: No active threat siblings identified within /24 subnet

Relationship Graph:

Four relationships mapped, all indicating same-network affiliation to VIL-IN. Limited correlation with external entities.

Recommended Actions:

Based on risk profile 40, the following firewall rules are recommended:

• iptables: `iptables -A INPUT -s 27.97.108.32 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 27.97.108.32 drop`
• nginx: `deny 27.97.108.32;`
• pfSense: `27.97.108.32/32`
• Cloudflare WAF: Block with expression `ip.src eq 27.97.108.32`
• AWS WAF: Add address `27.97.108.32/32` to rule set

SOC Analyst Notes:

This IP represents mobile carrier infrastructure with moderate risk scoring. The lack of open services and clean abuse density in the /24 subnet suggests benign mobile network traffic. However, the 40/100 risk score warrants monitoring. No immediate threat indicators present. Consider contextual analysis of traffic patterns before implementing block rules, as mobile carrier IPs may represent legitimate network activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.