106.12.18.199📋 Copy

# IP Intelligence Briefing: 106.12.18.199/32

## Executive Summary

IP address 106.12.18.199 is assigned to Baidu (ASN 38365) in China and presents a moderate risk profile. The endpoint is currently firewalled with no active services, though it has been flagged on 2 of 8 DNS blacklists. Historical observations confirm consistent ownership under Baidu's network infrastructure since 2011.

## Ownership & Network Classification

• Organization: Baidu Noc (Baidu - Beijing Baidu Netcom Science and Technology Co., Ltd.)
• ASN: 38365
• Network Block: 106.12.0.0/19
• Registry: APNIC
• Registration Date: 2011-03-22
• Classification: Infrastructure endpoint with no active services

## Geolocation

• Country: China (CN)
• Geo Consensus: Confirmed across multiple sources
• Accuracy Radius: 2,500 km

## Threat Assessment

• Overall Risk Score: 50/100 (Moderate Risk)
• Abuse Confidence: Not explicitly scored
• DNSBL Listings: 2 out of 8 total lists
• Known Attacker Status: False
• Tor Exit Node: False
• Spam Source: False

## Network State

• Open Ports: None detected
• Service Status: Firewalled / No Services
• Connection Type: Not residential, cloud, CDN, proxy, or VPN
• HTTP/TLS: No active HTTP or TLS services observed

## Historical Observations

Sixteen observations recorded since 2026-06-02. Key observations include:

• ASN 38365 confirmed via team-cymru-dns
• Geolocation consistently resolved to China (CN)
• Operator score maintained at 0.1304 (Minimal)
• No ownership changes recorded
• Threat persistence: 0 days
• No persistent malicious activity detected

## Relationship Graph

The IP maintains 21 relationship entries, all classified as "Same Network" relationships with Baidu. This indicates the address is part of Baidu's broader network infrastructure.

## Neighborhood Analysis

• Subnet: 106.12.18.199/24
• Abuse Density: 1
• Classification: Mostly clean
• Threat Siblings: 1 identified
• Active Siblings: 1

## Recommended Actions

No specific security actions were generated by the system for this IP. However, given the DNSBL listings and moderate risk score, the following measures are recommended:

1. Monitor DNSBL activity: Track changes in blacklist status across the 8 known lists

2. Firewall rules: Consider rate-limiting inbound traffic if services are ever activated

3. Continue monitoring: Maintain observation history for changes in network role or threat indicators

## Intelligence Assessment

This IP address represents Baidu infrastructure with moderate risk characteristics. The DNSBL listings suggest past abuse activity, but current network state shows no active services. The moderate risk score (50) reflects the combination of blacklist presence and the known association with a major Chinese internet provider.

Threat Level: MODERATE

Priority: LOW-MEDIUM

Recommended Action: MONITOR

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.