116.49.36.130📋 Copy

# IP Intelligence Briefing: 116.49.36.130

## Executive Summary

IP address 116.49.36.130 is classified as High Risk (Risk Score: 80) with a network role designation as "Firewalled / No Services." The IP is associated with IRT-HKTIMS-HK (NETVIGATOR) network infrastructure in Hong Kong. While the IP shows no active service exposure and no observed malicious campaigns, it is listed on 5 out of 8 DNSBLs, indicating prior reputation issues.

## Technical Profile

Ownership & Infrastructure:

• ASN: 4760 (Netvigator)
• Organization: IRT-HKTIMS-HK
• Network: NETVIGATOR (116.49.0.0/16)
• BGP Prefix: 116.49.32.0/19
• RIR: APNIC
• Registration: Validated via RDAP

Geolocation:

• Country: Hong Kong (HK)
• City: Hong Kong
• Coordinates: 22.4°N, 114.11°E
• Timezone: Asia/Hong_Kong
• Geo consensus: True across 1 source

Network Classification:

• Is Cloud: No
• Is CDN: No
• Is VPN/Proxy: No
• Is Tor Exit: No
• Is Hosting: No
• Is Residential: No
• Status: Firewalled / No Services

DNS Analysis:

• PTR Hostname: n1164936130.netvigator.com
• Forward Resolution: Confirmed
• SPF: Present
• DMARC: Present
• TXT Records: 0
• Forward Hostnames: 1

Threat Indicators:

• Abuse Confidence Score: Not calculated
• Blacklist Count: 5 DNSBL listings
• Known Campaigns: None observed
• Is Known Attacker: No
• Is Spam Source: No

Control Plane:

• Operator Score: 0.2609 (Basic)
• DNSSEC Valid: Yes
• Route Stability: False
• MOAS: No
• Route Changes (30d): 0

## Observation History

Total of 17 observations recorded. Most recent signals observed on 2026-07-28:

• Geolocation signals: Confirmed Hong Kong placement with 52% confidence
• Operator classification: Basic (30% raw score)
• Comprehensive signal evaluation: 5 total sources, 66.7% data sufficiency
• No persistent malicious behavior flagged
• Ownership changes: 0

## Relationships

7 total relationships identified:

• Network associations: NETVIGATOR (multiple entries)
• DNS associations: n1164936130.netvigator.com (3 DNS records)
• No organizational or certificate relationships detected

## Neighborhood Analysis

• Subnet: 116.49.36.130/24
• Neighbor Count: 0
• Abuse Density: 0%
• Risk Distribution: No sibling IPs with risk classifications
• No active or threat siblings detected

## Threat Assessment

The IP presents a moderate risk profile primarily driven by DNSBL listings (5 of 8 lists) rather than active malicious behavior. The IP is properly configured with SPF and DMARC records, indicating some level of email infrastructure management. However, the "High Risk" reputation score of 80 suggests historical abuse patterns or reputation degradation.

The firewalled status with no open services limits immediate exploitation vectors, but the IP should be monitored for any service activation or changes in behavior.

## Recommended Actions

• Monitor for service activation (open port scans)
• Review DNSBL listings for specific reasons of listing
• Consider blocking if email reputation is critical
• No immediate firewall rules recommended due to firewalled status
• Continue historical monitoring for pattern changes

---

*Report generated from IPDebrief intelligence platform. Data current as of analysis timestamp.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.