116.179.32.132📋 Copy

THREAT INTELLIGENCE BRIEFING

Target IP: 116.179.32.132/32

Classification: MODERATE RISK – BAI DU CRAWLER

---

EXECUTIVE SUMMARY

IP 116.179.32.132 is a mobile carrier IP assigned to China Unicom (ASN 4837) that resolves to a Baidu web crawler hostname. The IP carries a moderate risk score of 50 with zero known malicious indicators. While the IP itself shows no active threat behavior, it operates within a subnet (116.179.32.0/24) exhibiting 11.8% abuse density.

---

OWNERSHIP & GEOLOCATION

• Organization: IRT-UNICOM-CN (UNICOM)
• ASN: 4837
• Network Block: 116.128.0.0/10 (APNIC)
• Location: Jinrongjie, Xicheng District, Beijing, China
• Mobile Carrier: China United Network Communications (MCC 460, MNC 01)
• Connection Type: Mobile/LTE/5G

---

THREAT ASSESSMENT

• Risk Score: 50 (Moderate Risk)
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• DNSBL Listings: 2 out of 8 total lists
• Blacklist Count: 0
• Campaign Affiliation: None identified

---

NETWORK ROLE & SERVICES

• Infrastructure Type: Mobile Carrier
• Service Status: Firewalled / No Services Detected
• Open Ports: None
• TLS Certificates: None
• DNS Resolution: baiduspider-116-179-32-132.crawl.baidu.com
• Forward Resolution Confirmed: Yes

---

RELATIONSHIP MAPPING

• Primary Association: Baidu crawler hostname (baiduspider-116-179-32-132.crawl.baidu.com)
• Network: UNICOM
• DNS Associations: 3 records to same crawler hostname
• No External Certificate or Organization Links

---

SUBNET ANALYSIS (116.179.32.0/24)

• Abuse Density: 0.1183 (Low)
• Classification: Mostly Clean
• Total Siblings: 186
• Active Siblings: 36
• Threat Siblings: 22
• Risk Distribution: High (0), Medium (36), Low (37)

---

OBSERVATION HISTORY

• Total Signals: 17 observations recorded
• Geolocation Signals: Multiple country-level detections (CN) with confidence scores ranging 0.52-0.85
• Ownership Changes: None detected
• Threat Persistence: Not observed
• Persistence Days: 0
• Recent Activity: Signals observed July 2026 timeframe

---

RECOMMENDED ACTIONS

Immediate Mitigation:

```bash

# iptables

iptables -A INPUT -s 116.179.32.132 -j DROP

# nftables

nft add rule inet filter input ip saddr 116.179.32.132 drop

# pfSense

116.179.32.132/32

# nginx

deny 116.179.32.132;

```

WAF Configuration:

• Cloudflare WAF: Block with expression `ip.src eq 116.179.32.132`
• AWS WAF: Add IPSet entry for 116.179.32.132/32

Rationale: While the IP is associated with legitimate Baidu crawler infrastructure, it carries a moderate risk score and may be repurposed for scanning or abuse. The subnet's 11.8% abuse density warrants monitoring of related addresses.

---

ANALYST NOTES

• IP appears to be a legitimate Baidu search crawler operating from mobile carrier infrastructure
• No evidence of malicious activity or threat campaign participation
• Subnet shows elevated but not critical abuse density; consider monitoring sibling IPs with risk scores ≥50
• DNSBL presence suggests prior reputation concerns; investigate if crawler behavior has degraded

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.