112.91.139.223📋 Copy

# IPDebrief Intelligence Briefing

Target: 112.91.139.223/32

Classification: Low Risk / Infrastructure IP

Report Date: Current Analysis

---

## Executive Summary

IP 112.91.139.223 is a low-risk infrastructure address associated with ChinaUnicom telecommunications. The IP shows no active services, no open ports, and no threat indicators. Risk score is 25/100. Recommended action: No immediate blocking required.

---

## Risk Assessment

Risk Indicators:

• No known attack campaigns
• No blacklist hits (0/0)
• No Tor/VPN/proxy activity
• No spam source classification
• No known attacker indicators

---

## Ownership & Infrastructure

• Organization: ChinaUnicom Hostmaster (confirmed via RIR data, confidence 90%)
• RIR: APNIC (confidence 95%)
• BGP Origin: 112.91.139.0/24
• Origin ASN: 17623
• Network Classification: Provider/Telecommunications
• Route Stability: Unstable (isRouteStable: false)

---

## Geolocation

• Country: China (CN)
• Coordinates: 35.86°N, 104.2°E
• Confidence: 52% (Low-Medium)
• GeoSources: Multi-signal inference
• RIR Region: APNIC

---

## Network Services & Ports

• Open Ports: None detected
• HTTPS/TLS: No certificates observed
• HTTP Services: None
• Service Classification: Firewalled / No Services

---

## DNS & Reputation

• PTR Records: None
• Forward Resolution: No DNS entries
• DNSBL Listings: 1 of 8 total lists
• Domain Associations: None
• Email Reputation: No data available

---

## Neighborhood Analysis

• Subnet: 112.91.139.0/24
• Total Siblings: 0
• Abuse Density: 0%
• Threat Siblings: 0
• Inherited Risk: 0

No neighboring IPs with threat indicators detected.

---

## Behavioral Analysis

• Honeypot Hits: 0
• Enumeration Strikes: 0
• WAF Violations: 0
• Active Attacker Status: False
• Auto-Banned: False
• Total Incidents: 0

---

## Historical Observations (12 signals)

Recent activity (2026-07-30):

1. Geolocation: China (CN) - confidence 52%

2. Organization: ChinaUnicom Hostmaster - confidence 90%

3. RIR: APNIC - confidence 95%

4. Network Block: 112.88.0.0/13 (UNICOM-GD)

5. Port Scan: No active services detected

---

## Control Plane Data

• RPKI State: Not validated
• IRRC Consistency: Not applicable
• Route Changes (30d): 0
• MoAS Status: False
• DNSSEC Valid: True
• Has CAA: False

---

## Recommended Security Actions

No immediate actions required. The IP shows benign characteristics typical of telecommunications infrastructure.

Firewall Rules

• No blocking rules recommended
• Standard allow rules for ChinaUnicom networks may apply if whitelisting legitimate traffic

Monitoring Considerations

• Monitor for service activation if previously idle
• Track route stability changes
• Watch for DNSBL listing increases

---

## Conclusion

112.91.139.223 is a ChinaUnicom infrastructure IP with no active services, no threat indicators, and no historical malicious activity. The IP appears to be legitimately assigned telecommunications infrastructure. SOC teams may consider it low-priority for monitoring unless specific threat intelligence indicates otherwise.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.