110.179.80.241📋 Copy

# IP Intelligence Briefing: 110.179.80.241/32

## Executive Summary

IP address 110.179.80.241 is a mobile-terminated endpoint associated with China Telecom's infrastructure in China. The IP presents a low-risk profile (risk score: 25) with no active threat indicators, but exhibits historical threat signal associations. The subnet shows moderate abuse density with 3 threat-identified siblings among 16 total addresses.

---

## Ownership & Infrastructure

• ASN: 4134 (China Telecom - chinanet)
• Organization: IRT-CHINANET-SX
• Network Block: 110.177.0.0/16
• Location: China (CN)
• Connection Type: Mobile (LTE/5G) via China Telecom Corp. Ltd.
• Carrier: China Telecom (MCC: 460, MNC: 03)

---

## Threat Profile

• Risk Score: 25 (Low Risk)
• Abuse Confidence: None reported
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0
• Reputation Sources: None
• Known Campaigns: None identified

Notable: Control plane data indicates 1 DNSBL listing across 8 total lists. Operator score rated as "Minimal" (0.1304).

---

## Network Activity

• Open Ports: None detected
• Services: Firewalled / No Services
• DNS Resolution: No forward resolution, no PTR records
• Hosted Domains: 0
• Email Authentication: No SPF or DMARC records

---

## Historical Signals (14 Observations)

Recent observations indicate:

• Ownership: Consistent registration under IRT-CHINANET-SX (confidence: 0.90-0.95)
• Geolocation: Multiple sources confirm China placement with 2500km accuracy radius
• Threat Signals: Signal type 27 (AlienVault-OTX) shows threat indicators with pulse count of 2
• Geo Validation: ICMP blocked; distance 8033.2km from probe origin

---

## Neighborhood Assessment (110.179.80.0/24)

• Abuse Density: 0.1875 (18.75%)
• Classification: Mostly clean
• Total Siblings: 16
• Active Siblings: 8
• Threat Siblings: 3
• Inherited Risk: 7

Medium Risk Neighbors Identified:

• 110.179.80.67 (risk: 40)
• 110.179.80.147 (risk: 40)

---

## Recommended Actions

No specific firewall rules or blocking actions recommended at this time. The IP's low-risk profile and lack of active threat indicators support continued monitoring without aggressive mitigation.

---

## Intelligence Notes

• Persistence: Zero threat persistence days; not persistently malicious
• Campaign Association: No certificate or banner matches; zero correlated IPs
• Relationships: Single network association (sxtybas)
• Temporal Stability: No ownership changes observed

Analyst Recommendation: Monitor for escalation. While currently low-risk, the presence of threat signals in historical data and elevated-risk neighbors warrant periodic re-assessment.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.