# IP Intelligence Briefing: 61.246.248.171
## Executive Summary
IP address 61.246.248.171 is classified as Low Risk (Risk Score: 25/100) with no active threat indicators. The IP originates from India (Delhi) and shows minimal operator classification with no evidence of malicious activity, campaigns, or persistent abuse patterns.
## Technical Profile
Ownership & Routing
- Origin ASN: 9498
- BGP Prefix: 61.246.248.0/24
- Routing Stability: Route changes detected in the last 30 days (isRouteStable: false)
- RPKI State: Not validated
- DNSSEC: Valid
Geolocation
- Country: India (IN)
- Region: National Capital Territory of Delhi
- City: Delhi
- Coordinates: 28.65°N, 77.24°E
- Accuracy Radius: 1,500 km
- Timezone: Asia/Kolkata
Network Services
- Open Ports: None detected
- Service Classification: Firewalled / No Services
- DNS: No PTR records; forward resolution pending
- Email Auth: No SPF, DMARC, or TXT records
DNSBL Status
- DNSBL Listings: 1/8 lists checked
- Abuse Confidence: Not applicable
## Threat Indicators
- Known Attacker: No
- Spam Source: No
- Tor Exit Node: No
- Proxy: No
- VPN: No
- Cloud/CDN/Hosting: No
- Blacklist Count: 0
- Threat Feeds: None matched
- Known Campaigns: None
## Historical Observations (11 signals)
Analysis of observation history reveals:
- Geolocation Consistency: India/Delhi signals maintained across observations
- Operator Score: Minimal (0.1304)
- Confidence Levels: Signals ranged from 0.12 to 0.70 confidence
- Temporal Pattern: No escalation in risk signals over time
- Persistence: Threat persistence days: 0
## Neighborhood Analysis
- Subnet: 61.246.248.171/24
- Abuse Density: 0 (no abuse activity detected in subnet)
- Sibling IPs: 0 neighbors identified
- Risk Distribution: No high/medium/low risk neighbors found
## Relationship Graph
- Related Entities: None identified
- Linked Subnets: 0
- Linked Hostnames: 0
- Linked Organizations: 0
- Linked Certificates: 0
## Recommended Actions
Based on the Low Risk classification and minimal threat profile:
1. No immediate blocking required
2. Monitor for route stability changes (isRouteStable: false)
3. Verify DNSBL listing - 1/8 lists flagged; confirm source
4. Standard logging recommended for compliance
## Intelligence Narrative
IP 61.246.248.171 presents a low-risk profile with no evidence of malicious behavior. The IP is geolocated to Delhi, India, with stable origin routing through ASN 9498. Network reconnaissance detected no open ports or services, indicating either a properly secured endpoint or a passive infrastructure asset. The absence of relationships, neighbors, or historical threat escalation supports the low-risk classification. The single DNSBL listing warrants periodic verification but does not indicate immediate threat. This IP may be safely permitted with standard logging in place.
---
*Report generated: IPDebrief Intelligence Platform*
*Classification: Defensive Security Intelligence*
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Network Administrator |
| ASN | AS9498 |
| Network Name | BHARTI-IN |
| CIDR Block | 61.246.0.0/16 |
| RIR | APNIC |
| Country | IN |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 60% (Good) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Mobile |
| Service Purpose | Web Server |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| 8080 | http-alt | tcp | — |
| Closed Ports | 22, 25, 3389, 8443 (3 open / 7 scanned) | ||
| Server | Web server detected |
| HTTP Title | — |
🔐 TLS Certificate
CN=annotation.marktine.com was found on this IP. This may indicate a previously hosted website, a decommissioned service, or stale infrastructure.| SANs | annotation.api.marktine.comannotation.dev.api.marktine.comannotation.dev.marktine.comannotation.marktine.comapi.facedetection.marktine.comclient.management.api.marktine.comfacedetection.marktine.comportainer.facedetection.marktine.comstream-api.facedetection.marktine.com |
| Valid From | 2026-04-08T10:48:56+00:00 |
| Valid Until | 2026-07-07T10:48:55+00:00 (expired) |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_256_GCM_SHA384 |
| Signature Algorithm | sha384ECDSA |
| Validity Period | 89 days |
🛡️ Public Network Snapshot
| Origin ASN | AS9498 |
| Network Prefix | 61.246.248.0/24 |
| Route mapping | Found |
| HSTS | Not detected |
| CSP | Not detected |
| HTTP/2 | Not detected |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 25% | 1 | 1 |
| routing | 25% | 1 | 1 |
| services | 25% | 1 | 1 |
| ownership | 0% | 0 | 0 |
| reputation | 0% | 0 | 0 |
| geolocation | 0% | 0 | 0 |
| Overall | 12% | 3 | 3 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-07 06:28:11 UTC |
| Last Seen | 2026-08-27 01:11:21 UTC |
| Profile Built | 2026-08-29 06:41:58 UTC |
| Data Freshness | Live |
| Signal Types | 19 |
| Total Observations | 21 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 61.246.248.171
Who owns the IP address 61.246.248.171?
61.246.248.171 is registered to Network Administrator. The address falls within the 61.246.0.0/16 network block. Registration is held at APNIC.
Where is 61.246.248.171 located?
Geolocation data places 61.246.248.171 in Delhi, National Capital Territory of Delhi, India. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 61.246.248.171 malicious or safe?
61.246.248.171 currently carries a low risk assessment, meaning no significant threat indicators have been observed. This assessment is generated from continuously collected signals and can change over time.
What ports are open on 61.246.248.171?
Responsive ports observed on 61.246.248.171 include 80, 443, 8080. Port visibility reflects the most recent scan and may change as the host's configuration or firewall rules change.
Is 61.246.248.171 a VPN, proxy, or data center address?
61.246.248.171 is classified as a mobile network based on network ownership and behavioural analysis.