114.106.136.191📋 Copy

# IP Intelligence Briefing: 114.106.136.191/32

Classification: Moderate Risk | Date: July 2026 | Analyst: IPDebrief Intelligence Team

---

## Executive Summary

IP 114.106.136.191 is a moderate-risk (Score: 40) Chinese mobile infrastructure address assigned to CHINANET-AH under China Telecom. The IP is mobile-classified with no active services detected, 2 DNSBL listings, and 14 recent observation records. While no active threat indicators are present, the address warrants monitoring due to its mobile carrier classification and presence in a subnet with non-zero abuse density (0.25).

---

## Network Ownership & Classification

---

## Threat Assessment

• Risk Score: 40/100 (Moderate)
• Abuse Confidence: Not available
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• DNSBL Listings: 2 of 8 total lists
• Active Threat Indicators: None detected

Key Observations:

• No open ports detected (service classification: "Firewalled / No Services")
• No TLS certificates or HTTP services
• No PTR reverse resolution records
• No known malicious campaigns or correlated IPs

---

## Neighborhood Context (114.106.136.0/24)

Neighbor Risk Distribution:

• 114.106.136.8: Risk 25 (Low-Medium)
• 114.106.136.49: Risk 40 (Moderate)
• 114.106.136.202: Risk 25 (Low-Medium)

---

## Temporal Analysis

• Observation Count: 14 records
• Most Recent: 2026-07-18 06:44 UTC
• Ownership Changes: 0
• Threat Persistence Days: 0
• Is Persistently Malicious: No

Recent signals confirm consistent geolocation inference (CN, Hefei) and ownership attribution (Jinneng Wang/CHINANET-AH) with confidence levels ranging 0.40–0.95.

---

## Recommended Defensive Actions

Blocking Recommended: Yes (Risk Score 40)

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 114.106.136.191 -j DROP

# nftables

nft add rule inet filter input ip saddr 114.106.136.191 drop

# pfSense

block 114.106.136.191/32

# Cloudflare WAF

{"description":"Block 114.106.136.191 — IPDebrief risk score 40","action":"block","filter":{"expression":"ip.src eq 114.106.136.191"}}

# AWS WAF

{"Addresses":["114.106.136.191/32"],"Description":"IPDebrief risk 40"}

```

---

## SOC Analyst Notes

• Primary Concern: Mobile-classified IP with moderate risk score and DNSBL presence
• Context: Infrastructure IP (no services) reduces likelihood of active exploitation but may indicate compromised endpoint or misconfiguration
• Recommendation: Implement block rule with monitoring; consider geographic filtering for China-based mobile traffic if operational policy permits
• Further Investigation: Monitor subnet 114.106.136.0/24 for correlated activity; investigate the 1 threat sibling (114.106.136.49) if anomalies detected

---

*Report generated from IPDebrief intelligence data. Recommendations are probabilistic and should be combined with additional signals before enforcement.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.