115.190.165.165📋 Copy

Threat Intelligence Briefing for IP 115.190.165.165/32

1. Core Profile

• Risk Assessment: Low risk (riskScore: 0, providerScore: 0, authorityScore: 0).
• Ownership: Owned by IRT-VOLCANO-ENGINE-CN (ASN 137718), associated with ByteDance.
• Geolocation: Registered to China (CN) but lacks precise city/region data.
• Network Role: Firewalled with no open services or TLS certificates detected.
• Threat Indicators: No malicious activity, spam, or known attacker associations.

2. Observation History

• Recent Activity: 11 observations over 30 days, including geolocation inferences and ownership data.
• Trends: No persistent threats or changes in risk signals.
• Geolocation: Multi-signal inference places it in China (latitude 35.86, longitude 104.2) with ~2,500km accuracy.

3. Network Relationships

• Linked Entities:

- Same network: VOLCANO-ENGINE (CIDR 115.190.0.0/15).

- No connections to known malicious organizations, domains, or certificates.

4. Subnet Neighborhood

• Subnet: 115.190.165.0/24.
• Neighbor Risk: Two neighbors (115.190.165.93, 115.190.165.143) have medium risk scores (25/100), while one (115.190.165.22) is low risk.
• Abuse Density: Subnet has no reported abuse incidents.

5. Actionable Insights

• Monitor Neighbors: Focus on 115.190.165.93 and 115.190.165.143 for potential risk escalation.
• Verify Network Segmentation: Confirm firewalled nature of 115.190.165.165 to ensure it’s not inadvertently exposing internal assets.
• Check for Anomalies: Track changes in the VOLCANO-ENGINE subnet for unexpected traffic patterns.

Conclusion: This IP is part of a low-risk infrastructure owned by a Chinese organization. While no direct threats are detected, its subnet contains medium-risk neighbors warranting closer scrutiny. SOC teams should prioritize monitoring network segmentation and neighbor behavior.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.