113.31.186.196📋 Copy

# IP INTELLIGENCE BRIEFING: 113.31.186.196

Classification: Moderate Risk

Date: Current

Prepared For: SOC Operations Team

---

## EXECUTIVE SUMMARY

IP 113.31.186.196/32 is a Chinese-origin IP address assigned to UCLOUD-NET (ASN 4811, organization: Jinhui Jia). The address carries a moderate risk score of 50 and shows no active malicious indicators. The IP is currently firewalled with no open services detected. The IP appears in the neighborhood of 113.31.186.0/24 subnet, which exhibits moderate abuse density (0.5) with one identified threat sibling.

---

## RISK PROFILE

Network Ownership:

• ASN: 4811
• Organization: Jinhui Jia / UCLOUD-NET
• CIDR Block: 113.31.160.0/19
• RIR: APNIC (Asia-Pacific)
• Registration: Available via RDAP

Geolocation:

• Country: China (CN)
• Geographic Validity: Plausible
• Distance: 8,033.2 km (validation: ICMP blocked)

---

## THREAT INDICATORS

Active Threats: None Detected

• Is Tor Exit: False
• Is Known Attacker: False
• Is Spam Source: False
• Blacklist Count: 0
• Known Campaigns: None

DNSBL Status:

• Listed on 2 of 8 DNSBL feeds
• Operator Score: 0.1304 (Minimal)

Services:

• Open Ports: None detected
• HTTP Title: None
• TLS Certificate: None
• Connection Status: Firewalled / No Services

---

## NETWORK NEIGHBORHOOD ANALYSIS

Subnet: 113.31.186.0/24

• Total Siblings: 2
• Active Siblings: 1
• Threat Siblings: 1
• Abuse Density: 0.5
• Classification: Mostly Clean

Adjacent IP of Note:

• IP 113.31.186.194
• Risk Score: 25 (Low-Moderate)
• Authority Score: 50

---

## RELATIONSHIP GRAPH

All relationship data points to UCLOUD-NET network infrastructure. No links to known threat actors, malicious domains, or suspicious certificate authorities were identified.

---

## OBSERVATION HISTORY

Total Observations: 16 signals recorded

Most Recent: 2026-07-29

Threat Persistence: None detected

• Is Persistently Malicious: False
• Threat Observation Count: 0

Historical signals indicate no persistent malicious behavior. Recent observations confirm:

• No service enumeration strikes
• No WAF violations
• No honeypot hits
• Ownership stability: No changes recorded

---

## RECOMMENDED ACTIONS

Firewall Recommendations:

```bash

# iptables

iptables -A INPUT -s 113.31.186.196 -j DROP

# nftables

nft add rule inet filter input ip saddr 113.31.186.196 drop

# nginx

deny 113.31.186.196;

```

Cloud WAF Recommendations:

• Cloudflare: Block 113.31.186.196 (IPDebrief risk score 50)
• AWS WAF: Add address 113.31.186.196/32 to block list

Note: Recommendations are probabilistic and should be combined with additional contextual signals before implementation.

---

## INTELLIGENCE ASSESSMENT

IP 113.31.186.196 presents a moderate risk profile with no active malicious indicators. The IP is associated with legitimate cloud infrastructure (UCLOUD-NET) but shows DNSBL listings and operates in a neighborhood with elevated abuse density. Current firewalling prevents direct service exposure.

Recommendations:

1. Monitor the IP for changes in risk score or new threat indicators

2. Watch adjacent subnet 113.31.186.0/24 for correlated malicious activity

3. Block at perimeter level per current risk score (50)

4. Review any log hits from this IP for context-specific anomalies

---

*Report generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.