117.50.130.195📋 Copy

# IP Intelligence Briefing: 117.50.130.195/32

## Executive Summary

IP 117.50.130.195 presents a low-risk profile (risk score: 25) with minimal observed threat indicators. The address is geolocated to China (CN) with moderate confidence and is listed on one of eight DNSBLs. No active services are detected, and the subnet exhibits low abuse density.

## Technical Profile

• Risk Score: 25 (Low Risk)
• ASN: 23724
• BGP Prefix: 117.50.128.0/19
• Geolocation: China (35.86°N, 104.2°E) – confidence: 0.35
• DNS Resolution: PTR hostnames unresolved; forward DNS confirmed false
• Service Status: Firewalled / No Services detected (no open ports, TLS certificates, or HTTP responses)
• DNSSEC: Valid (confidence: 0.90)
• Reputation: Low Risk

## Threat Indicators

• Abuse Confidence Score: Not populated
• Blacklist Status: Listed on 1 of 8 DNSBLs (max severity: high)
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Known Campaigns: None identified
• Behavioral Signals: 0 honeypot hits, 0 enumeration strikes, 0 WAF violations

## Observation History

Seven observations recorded through 28 July 2026. Key signals include:

• Geolocation consistently reported as CN with low confidence (0.35)
• DNSSEC validation confirmed across observations
• Blacklist presence detected with high severity rating (confidence: 0.85)
• No persistent malicious behavior observed

## Subnet Analysis (117.50.130.0/24)

• Total Neighbors: 31
• Abuse Density: 0
• Risk Distribution: 0 high-risk, 0 medium-risk, 30 low-risk
• Notable Neighbors: Multiple IPs (117.50.130.60, 130.79, 130.82, 130.92, 130.105, 130.128, 130.148, 130.156, 130.159, 130.161, 130.182, 130.185, 130.186, 130.197, 130.208, 130.213, 130.229, 130.233, 130.250) share risk score 25 with authority score 50
• Relationship Graph: No connected entities identified

## Recommended Actions

No specific firewall or mitigation rules generated. The IP's low risk score and lack of active services suggest standard monitoring protocols are sufficient.

## Intelligence Assessment

This IP address operates within a residential or infrastructure subnet with minimal threat activity. The single DNSBL listing warrants continued monitoring but does not indicate active malicious behavior. The absence of open services and low-risk neighborhood context supports a low-priority classification. No immediate blocking or escalation required; maintain standard logging and observation practices.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.