116.179.32.89📋 Copy

# IP Intelligence Briefing: 116.179.32.89/32

Classification: Low Risk / Baidu Search Infrastructure

Date: 2026-07-23

Analyst: IPDebrief Intelligence

---

## Executive Summary

IP 116.179.32.89 is a mobile-originated IP address belonging to China Unicom's infrastructure, associated with Baidu's search crawler infrastructure. The address presents a low risk profile (Risk Score: 25) with no active threat indicators. The IP is part of a mobile carrier network (China Unicom, MCC: 460, MNC: 01) and resolves to a Baidu spider hostname, indicating legitimate search engine crawler activity.

---

## Technical Profile

Network Ownership:

• ASN: 4837 (IRT-UNICOM-CN)
• Organization: UNICOM
• CIDR Block: 116.128.0.0/10
• RIR: APNIC
• Mobile Carrier: China United Network Communications (LTE/5G)

Geolocation:

• Country: China (CN)
• Region: Beijing
• City: Jinrongjie (Xicheng District)
• Coordinates: 34.77°N, 113.72°E
• Geo Consensus: Validated across multiple sources

DNS Resolution:

• PTR Record: baiduspider-116-179-32-89.crawl.baidu.com
• Forward Resolution: Confirmed → baidu.com
• Domain: baidu.com
• Email Authentication: SPF and DMARC records present

---

## Threat Assessment

Risk Indicators:

• Overall Risk Score: 25 (Low Risk)
• Abuse Confidence: Not applicable (no abuse signals)
• Blacklist Count: 0
• Known Campaigns: None
• Threat Feeds: No matches

Malicious Activity Flags:

• Not a Tor exit node
• Not a known attacker
• Not a spam source
• No active threat indicators

Network Classification:

• Infrastructure Type: Mobile network
• Connection Type: Firewalled / No Services
• Open Ports: None detected
• Service Purpose: No active services

---

## Control Plane & Routing

BGP Information:

• Origin ASN: 4837
• BGP Prefix: 116.179.0.0/16
• Route Stability: Unstable (isRouteStable: false)
• RPKI State: Not verified
• IRR Consistency: Not assessed

DNS Security:

• DNSSEC: Valid
• DNSBL Listings: 1 out of 8 total lists
• Operator Score: 0.2609 (Basic)

---

## Historical Observations

Signal Count: 17 observations recorded

Recent Signals (2026-07-23):

• Geolocation: Confirmed China (CN) with multi-signal inference at 0.52 confidence
• Ownership: No ownership changes detected
• Network Classification: Mobile carrier confirmed
• Operator Assessment: Basic classification with 0.3 raw score

Temporal Analysis:

• Ownership Changes: 0
• Threat Persistence: None observed
• Threat Observation Count: 0
• Persistence Status: Not persistently malicious

---

## Network Neighborhood Analysis

Subnet: 116.179.32.89/24

• Total Siblings: 186 IPs
• Active Siblings: 36
• Threat Siblings: 22 (11.8% threat rate)
• Abuse Density: 0.1183
• Classification: Mostly Clean

Risk Distribution in /24:

• High Risk: 0 IPs
• Medium Risk: 37 IPs
• Low Risk: 36 IPs

Notable Neighbors:

• 116.179.32.12 through 116.179.32.16: Risk Score 50, Authority Score 60

---

## Related Entities

Network Associations:

• UNICOM network infrastructure

DNS Associations:

• baiduspider-116-179-32-89.crawl.baidu.com (Baidu search crawler)

---

## Security Recommendations

Immediate Actions:

• No firewall rules required (Low Risk profile)
• No blocking recommended
• Monitor for changes in DNS resolution or service activity

SOC Guidance:

1. Allow Traffic: This IP is associated with legitimate Baidu search infrastructure

2. Monitor Mobile Origin: Verify traffic originates from mobile networks as expected

3. DNS Validation: Confirm continued association with baidu.com domain

4. Threshold Review: Neighboring IPs show moderate risk (score 50) - consider monitoring subnet activity patterns

Recommended Firewall Policy:

• No specific rules required for this IP
• Standard mobile carrier allow rules apply
• Consider monitoring for anomalies in traffic patterns

---

## Conclusion

IP 116.179.32.89 represents legitimate infrastructure for Baidu's search crawler operations, hosted on China Unicom's mobile network. The IP presents no malicious indicators and should be treated as trusted infrastructure. The /24 subnet shows moderate activity with 22 threat-identified sibling IPs, but this address itself remains clean. Continue monitoring for changes in DNS associations or service patterns.

---

*Report generated using IPDebrief intelligence platform. Data accuracy subject to real-time network changes.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.