114.106.147.92📋 Copy

# INTELLIGENCE BRIEFING: 114.106.147.92/32

## Executive Summary

IP address 114.106.147.92 presents a low-risk threat profile with an overall risk score of 25 (Low Risk). The IP is associated with China Telecom's mobile network infrastructure within the CHINANET-AH autonomous system (ASN 4134). No active malicious indicators were identified during analysis.

## Technical Profile

Ownership & Network:

• ASN: 4134 (CHINANET-AH)
• Organization: Jinneng Wang
• CIDR Block: 114.104.0.0/14
• RIR: APNIC

Geolocation:

• Country: China (CN)
• Region: Hefei
• Coordinates: 35.86°N, 104.2°E (2,500km accuracy radius)

Connection Characteristics:

• Mobile Carrier: China Telecom (MCC: 460, MNC: 03)
• Connection Technology: LTE/5G
• Service Purpose: Firewalled / No Services
• No open ports detected

DNS & Email:

• Forward resolution: Not confirmed
• PTR hostnames: None
• Email authentication: SPF, DMARC not configured
• Hosted domains: None

## Threat Indicators

• Abuse Confidence Score: Not calculated
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Proxy/VPN/Cloud: No
• Blacklist Count: 0
• DNSBL Lists: 1 out of 8 total lists
• Known Campaigns: None
• Threat Persistence Days: 0

## Neighborhood Analysis (114.106.147.0/24)

• Subnet Classification: Mostly Clean
• Abuse Density: 0.1429 (14.29%)
• Total Siblings: 7 (6 discovered)
• Risk Distribution: 0 high-risk, 1 medium-risk, 5 low-risk
• Notable Neighbor: 114.106.147.82 (Risk Score: 40)

## Observation History

• Total Observations: 14
• Recent Classification: Mostly Clean
• Inherited Risk: 2
• Persistent Malicious Behavior: No
• Ownership Changes: 0
• Threat Observation Count: 0

## Risk Assessment

The IP demonstrates characteristics typical of legitimate mobile network infrastructure. The firewalled status with no services open reduces attack surface. Geographic location within China's major telecommunications infrastructure (CHINANET) combined with China Telecom mobile carrier association suggests normal cellular network activity. The single DNSBL listing requires contextual investigation but does not independently indicate malicious activity.

## Recommended Actions

No immediate blocking recommended. Risk score of 25 falls within low-risk thresholds. If traffic from this IP is observed:

1. Monitor for unusual patterns (volume, timing, destination)

2. Contextualize against baseline traffic patterns

3. Investigate if associated with any specific attack indicators

4. Consider allowlisting if legitimate business communications are expected

## Intelligence Confidence

Medium - Data indicates low-risk profile with limited threat indicators. Continuous monitoring advised for mobile network traffic patterns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.