113.65.249.32📋 Copy

# IP Intelligence Briefing: 113.65.249.32/32

## Executive Summary

IP address 113.65.249.32 presents a Moderate Risk profile (Risk Score: 55/100) from Guangdong Province, China. The address is assigned to IPMASTER CHINANET-GD (ASN 4134) under the China Telecom mobile carrier infrastructure. While no active threat indicators were detected, the elevated risk score combined with mobile carrier association warrants defensive monitoring and selective blocking.

## Profile Details

## Risk Assessment

• Overall Risk Score: 55/100 (Moderate Risk)
• Abuse Confidence Score: Not available
• Blacklist Count: 0
• Known Campaigns: None identified
• Threat Persistence: Not persistently malicious

## Technical Indicators

• Open Ports/Services: None detected (firewalled/no services)
• DNS: No PTR records, no hosted domains
• TLS Certificates: None
• BGP Route: 113.64.0.0/11 (Route stable)
• RPKI State: Not found
• DNSBL Listings: 3 of 8 lists

## Network Context

• Subnet Classification: Clean (113.65.249.32/24)
• Abuse Density: 0%
• Threat Siblings: 0
• Total Siblings: 1
• Control Plane: Route stable, no route changes in 30 days

## Historical Observations

Analysis of 25 historical observations reveals:

• Recent Activity: Certificate queries detected on 2026-06-22
• Geolocation Signals: Multi-signal inference consistently placing address in China (Guangzhou region)
• Threat Observations: 1 threat observation recorded
• Risk Trend: Stable with no escalation pattern detected

## Intelligence Relationships

• 30 network relationships identified, all mapping to CHINANET-GD infrastructure
• No external organizational or hostname relationships detected
• All relationships classified as "Same Network"

## Recommended Actions

Immediate (High Priority)

1. Increase Logging: Monitor all traffic from this IP source with enhanced verbosity

2. Selective Blocking: Implement firewall rules to drop traffic from 113.65.249.32/32

Firewall Rules

```bash

# iptables

iptables -A INPUT -s 113.65.249.32 -j DROP

# nftables

nft add rule inet filter input ip saddr 113.65.249.32 drop

# nginx

deny 113.65.249.32;

# Cloudflare WAF

{"description":"Block 113.65.249.32 — IPDebrief risk score 55","action":"block","filter":{"expression":"ip.src eq 113.65.249.32"}}

# AWS WAF

{"Addresses":["113.65.249.32/32"],"Description":"IPDebrief risk 55"}

```

Operational Notes

• The mobile carrier association suggests potential for residential or IoT device activity
• Zero open services detected indicates the address may be a client endpoint or proxy
• Consider correlating with other mobile traffic patterns from the 113.64.0.0/11 prefix

## Conclusion

While this IP lacks direct threat indicators, the moderate risk score (55/100) combined with mobile carrier infrastructure warrants defensive posture. Recommend implementing blocking rules and monitoring for correlation with other malicious activity. Reassess after 7 days if no legitimate traffic patterns emerge.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.