111.198.220.150📋 Copy

# IP Intelligence Briefing: 111.198.220.150/32

## Executive Summary

IP address 111.198.220.150 presents a Low Risk profile (Risk Score: 25/100) with no active threat indicators. The address is associated with Chinese telecommunications infrastructure (UNICOM-BJ, ASN 4808) and operates as a firewalled endpoint with no accessible services. Current neighborhood analysis shows a clean subnet (111.198.220.0/24) with zero abuse density.

---

## Technical Profile

Ownership & Network Classification

• Organization: sun ying (ASN 4808)
• Country: CN (China)
• City: Jinrongjie (Xicheng District), Beijing
• BGP Prefix: 111.198.192.0/18
• Network Type: Firewalled / No Services
• Route Stability: False (route changes detected)

Risk Assessment

Service Exposure

• Open Ports: None detected
• TLS Certificate: None
• DNS Records: No PTR hostnames, no forward resolution
• Email Auth: No SPF/DMARC records

---

## Threat Indicators

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Malware/C2: No campaigns detected
• Honeypot Hits: 0
• WAF Violations: 0

DNSBL Status

• Listed on 1 of 8 DNSBL lists (current profile shows 0 active listings)
• Historical data indicates prior blacklist presence

---

## Neighborhood Analysis (111.198.220.0/24)

• Subnet Classification: Clean
• Abuse Density: 0 (No abuse activity detected)
• Threat Siblings: 0
• Risk Distribution: All low/zero
• Active Siblings: 0

---

## Relationship Graph

All 12 relationship edges point to network-level association: UNICOM-BJ. No hostname, organization, or certificate relationships detected beyond network infrastructure.

---

## Observation History

Sixteen observations collected since early 2026. Key findings:

• Geolocation: Consistent CN attribution with 2,500km accuracy radius
• Reputation Signals: Mixed confidence levels (0.20-0.85)
• Threat Persistence: 0 threat observation days
• Ownership Changes: None recorded

Recent observations (June 2026) show stable low-risk posture with no emerging threat patterns.

---

## Recommended Actions

No immediate blocking or mitigation actions recommended. The IP:

• Maintains below-threshold risk score (25)
• Shows no active malicious indicators
• Resides in a clean subnet (0 abuse density)
• Has no accessible services to target

SOC Guidance: Monitor passively. No firewall rules required at this time. Include in baseline traffic monitoring if observed in legitimate communications.

---

*Report generated from IPDebrief intelligence platform. Data current as of analysis timestamp.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.