112.94.5.43📋 Copy

IP Intelligence Briefing: 112.94.5.43

*Generated via IPDebrief Threat Intelligence Platform*

---

**Key Risk Indicators**

• Risk Score: 80/100 (High Risk)
• Threat Observations:

- Listed in 5/8 DNSBLs (high severity)

- ICMP blocking detected (traceroute validation failure)

- No direct malware, C2, or exploit indicators

---

**Network & Ownership**

• ASN: 17622 (IRT-CU-CN)
• Organization: China Unicom Guangzhou network (CN)
• Geolocation:

- Country: China (CN)

- Geo-plausible (2500km accuracy radius)

- Traceroute suggests ~8000km distance (potential misrouting)

---

**Behavioral & Technical Context**

• Network Role: Firewalled / No Services (no open ports, TLS, or HTTP signatures)
• Subnet: 112.94.5.43/24 (clean neighborhood, 0 abuse density)
• DNSSEC: Validated
• BGP: Route stable (no recent changes)

---

**Observation Trends**

• Recent Activity:

- 15 observations since 2026-06-04

- DNSBL listings (5/8) and geo-validation anomalies persist

- No new threat indicators or service exposure

---

**SOC Action Plan**

1. Monitor: Track DNSBL listings and ICMP behavior for evasion tactics.

2. Validate: Confirm if DNSBL entries are false positives or part of a broader campaign.

3. Isolate: Apply restrictive rules (e.g., `iptables -A INPUT -s 112.94.5.43/32 -j DROP`) if further activity is detected.

4. Contextualize: Cross-reference with 112.94.4.0/23 BGP prefix for network-level analysis.

---

*Note: No immediate actionable threats detected, but high-risk DNSBL association warrants continued monitoring.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.