117.159.93.197📋 Copy

## Intelligence Briefing: 117.159.93.197/32

Classification: HIGH RISK

Date: 2026-06-22

Analyst: IPDebrief Intelligence Team

---

Executive Summary

IP 117.159.93.197 is classified as High Risk (Score: 80) and operates as a mobile carrier infrastructure endpoint in Zhengzhou, Henan Province, China (ASN 24445, IRT-CHINAMOBILE-CN). The address shows elevated threat indicators including six DNSBL listings across eight total blacklist sources, despite being classified within a "mostly clean" subnet environment. No active services were detected on the endpoint.

---

Technical Profile

---

Threat Indicators

• DNSBL Presence: The IP is listed on six DNSBL feeds (6 of 8 total lists), indicating prior malicious activity or reputation issues
• No Active Services: No open ports or listening services detected; endpoint appears firewalled
• Mobile Carrier Context: Infrastructure classified as mobile carrier rather than hosting or proxy infrastructure
• No Known Campaigns: No active threat campaigns correlated to this IP

---

Historical Observation (23 Signals)

Recent signal history shows 23 observations spanning 2026-06-17 to 2026-06-22:

• 2026-06-22: DNSSEC, routing, services, ownership, reputation, and geolocation signals collected (6 dimensions)
• 2026-06-17: Subnet abuse density assessment and network classification signals
• Temporal Pattern: Observations indicate transient activity with varying confidence levels (0.23–0.60)

---

Network Relationships

• Network Association: 25 relationships mapped to CMNET (China Mobile Network)
• DNS Associations: 2 hostname associations recorded, showing timeout errors to 192.168.2.108#53 (internal/residential gateway)
• Control Plane: Route stability flagged as false; RPKI state and IRR consistency not validated

---

Neighborhood Analysis (117.159.93.0/24)

• Subnet Classification: Mostly clean
• Abuse Density: 1/255 (low)
• Threat Siblings: 1
• Active Siblings: 1
• Inherited Risk: 2
• Neighbor Count: 0 immediate /24 neighbors

---

Recommended Actions

Based on the High Risk classification and DNSBL presence:

1. Monitor for Outbound Traffic: Despite firewalled status, the IP's risk profile warrants monitoring for outbound connection attempts

2. Review DNSBL Listings: Investigate the 6 DNSBL sources to understand the basis for listings

3. Correlate with CMNET Traffic: Cross-reference with China Mobile network logs for activity patterns

4. Consider Block: Given risk score of 80 and multiple blacklist sources, consider implementing firewall rules to block inbound/outbound traffic

---

Conclusion

IP 117.159.93.197 represents a mobile carrier infrastructure endpoint with elevated risk characteristics primarily driven by DNSBL presence. While no active services were detected, the combination of high risk score, multiple blacklist listings, and mobile carrier context warrants continued monitoring. The subnet shows low abuse density, suggesting this IP may be an isolated high-risk endpoint rather than part of a broader malicious network.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.