1.183.173.204📋 Copy

# IP INTELLIGENCE BRIEFING: 1.183.173.204/32

Date: 2026-07-17

Classification: Moderate Risk (Score: 55/100)

Jurisdiction: People's Republic of China (CN)

---

## EXECUTIVE SUMMARY

IP 1.183.173.204 is a moderate-risk address associated with China Telecom's mobile infrastructure. The IP shows no direct threat indicators but maintains a risk score of 55/100 due to DNSBL listings and mobile carrier association. No active threat campaigns, known attacker status, or spam source classification detected.

---

## OWNERSHIP & INFRASTRUCTURE

Geolocation: China (CN), 34.7732°N, 113.722°E — confidence 0.70 (Multi-signal inference)

---

## THREAT INDICATORS

Abuse Confidence: Not scored

Control Plane: Route stable (isRouteStable: false), BGP prefix 1.180.0.0/14

---

## NETWORK CONTEXT

Subnet Analysis (1.183.173.0/24):

• Abuse Density: 0
• Total Siblings: 1
• Threat Siblings: 0
• Neighbor: 1.183.173.116 (Risk: 25/100, Authority: 50)

Relationship Graph:

• 3 relationships identified, all to CHINANET-NM network block
• No external associations to hostnames, organizations, or certificates detected

---

## OBSERVATION HISTORY

Total Observations: 13

Recent Signals:

• 2026-07-17T23:45:25 — Geo: China (confidence 0.52), coordinates 35.86°N, 104.2°E
• 2026-07-17T23:41:44 — Ownership: IRT-CHINANET-CN (confidence 0.90)
• 2026-07-17T23:42:00 — Geo: China (confidence 0.70) via MaxMind GeoLite2

Temporal Analysis:

• Ownership changes: 0
• Threat observation count: 0
• Is persistently malicious: False

---

## SERVICES & PORTS

• Open Ports: None detected
• TLS Certificate: None
• HTTP Title: None
• Hosted Domains: 0
• DNS PTR Records: None
• Forward Resolution: 0

---

## RECOMMENDED ACTIONS

Primary Recommendation: Increase logging verbosity and monitor recent activity from this IP due to elevated risk score (55/100).

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 1.183.173.204 -j DROP

# nftables

nft add rule inet filter input ip saddr 1.183.173.204 drop

# nginx

deny 1.183.173.204;

# pfSense

1.183.173.204/32

# Cloudflare WAF

{"description":"Block 1.183.173.204 — IPDebrief risk score 55","action":"block","filter":{"expression":"ip.src eq 1.183.173.204"}}

# AWS WAF

{"Addresses":["1.183.173.204/32"],"Description":"IPDebrief risk 55"}

```

---

## ANALYST NOTES

This IP resides within China Telecom's mobile network infrastructure (1.180.0.0/14 block). While no direct threat indicators are present, the moderate risk score derives from DNSBL listings and mobile carrier association. The subnet shows low abuse density with only one neighbor (1.183.173.116) showing low-risk classification. Monitor for any service activity or port scanning behavior. No immediate threat mitigation required unless observed network behavior aligns with threat actor patterns.

Status: Monitor — No immediate blocking required unless additional threat context emerges.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.