114.80.39.74📋 Copy

# IP Intelligence Briefing: 114.80.39.74/32

Classification: Moderate Risk – No Active Threat Indicators

Date of Analysis: 2026-07-29

Analyst: IPDebrief Intelligence Team

---

## Executive Summary

IP address 114.80.39.74 is assigned to ASN 4811 (CHINANET-SH) under organization Weng Wen Qian. The IP is geolocated to Shanghai, China, and is classified as "Firewalled / No Services" with no open ports or active services detected. Risk scoring indicates moderate risk (50/100) primarily due to DNSBL listings (2 of 8), though no active threat indicators or malicious campaigns have been observed.

---

## Infrastructure Profile

Network Classification: Not classified as cloud, CDN, VPN, proxy, Tor exit, hosting, or residential infrastructure. No active services detected.

---

## Threat Intelligence Assessment

Risk Scoring

• Overall Risk Score: 50 (Moderate)
• Abuse Confidence Score: Not available
• Blacklist Count: 0 active listings
• Threat Feeds: None populated

Service Enumeration

• Open Ports: None
• TLS Certificates: None
• HTTP Services: None detected
• DNS Records: No PTR, no forward resolution, no hosted domains
• Email Authentication: SPF/DMARC not configured

Threat Indicators

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Campaign Association: None detected
• Total Incidents: 0

---

## Neighborhood Analysis

The /24 subnet (114.80.39.0/24) shows minimal activity:

• Total Siblings: 2
• Active Siblings: 0
• Threat Siblings: 0
• Abuse Density: 0 (clean classification)
• Neighbor Risk Profile: 1 sibling (114.80.39.66) with risk score 25/100

No elevated risk signals from neighboring IPs.

---

## Historical Observations

Observation Count: 15 signals recorded

Key historical signals include:

• 2026-07-29 12:24: Traceroute completed (30 hops, target not reached)
• 2026-07-29 12:20: Ownership stability confirmed (0 changes)
• 2026-07-29 12:18: Geographic inference to CN (Shanghai region, 52% confidence)
• 2026-07-29 12:17: Network classification confirmed (not CDN/Tor/VPN/hosting)

No persistent malicious behavior detected over observation window.

---

## Control Plane Data

• DNSBL Listings: 2 of 8 total lists
• RPKI State: Not validated
• IRR Consistency: Not determined
• Route Changes (30d): 0
• Operator Score: 0.1304 (Minimal)
• GeoValidation: ICMP blocked – unable to validate

---

## Recommended Security Actions

Firewall Rules

Note: These recommendations are probabilistic and should be combined with other signals before taking action.

---

## Intelligence Assessment

This IP address represents a low-to-moderate risk asset with no active malicious indicators. The moderate risk score (50) stems primarily from DNSBL presence rather than observed threat activity. The infrastructure shows no signs of being compromised or used for malicious purposes. The /24 neighborhood remains clean with minimal sibling activity.

Recommended Action: Monitor. No immediate blocking required unless additional threat indicators emerge. Standard logging and monitoring recommended.

---

*Report generated using IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.