117.60.127.160📋 Copy

## IP Intelligence Briefing: 117.60.127.160/32

Executive Summary

IP address 117.60.127.160 was analyzed as a mobile carrier endpoint associated with China Telecom within the Chinanet infrastructure. The IP registered a risk score of 50, classified as moderate risk. No active threat indicators or malicious campaigns were detected during analysis.

Ownership and Network Classification

The IP address belongs to ASN 4134 (Chinanet Hostmaster) within the CHINANET-JS network block (117.60.0.0/14). Geolocation data indicated China (CN) with a 2,500 km accuracy radius. Network classification identified the endpoint as mobile (China Telecom carrier, MCC 460, MNC 03, LTE/5G technology). Services assessment revealed no open ports; the endpoint was classified as "Firewalled / No Services."

Threat Assessment

Threat analysis returned no indicators of malicious activity. The IP was not identified as a Tor exit node, known attacker, or spam source. Blacklist analysis showed zero entries. DNSBL assessment returned 2 listings out of 8 total lists. Campaign correlation analysis indicated no likelihood of malicious activity with zero certificate matches and zero correlated IPs.

Neighborhood Analysis

The /24 subnet (117.60.127.0/24) was classified as clean with an abuse density of 0. The neighborhood contained 4 total sibling IPs, all active, with no threat siblings detected. Risk distribution showed 1 medium-risk IP (117.60.127.79, risk score 50) and 2 low-risk IPs (117.60.127.75 and 117.60.127.243, risk score 25 each).

Observation History

Signal observation history contained 17 observations. Threat persistence analysis showed 0 days of malicious persistence with 0 threat observation count. Geolocation validation was impeded by ICMP blocking, though geoPlausible status remained true with a minimum possible RTT of 160.66 ms.

Recommended Actions

Based on the risk profile, blocking was recommended. The following firewall rules were generated:

• iptables: `iptables -A INPUT -s 117.60.127.160 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 117.60.127.160 drop`
• nginx: `deny 117.60.127.160;`
• pfSense: `117.60.127.160/32`
• Cloudflare WAF: Block with expression `ip.src eq 117.60.127.160`
• AWS WAF: Add `117.60.127.160/32` to block list

Analyst Notes

The IP represents a mobile carrier endpoint with moderate risk classification. The moderate risk score appears driven by DNSBL listings rather than active threat indicators. The neighborhood subnet demonstrates low abuse density with no threat siblings, suggesting the risk is isolated to this specific endpoint. SOC teams should evaluate whether the moderate risk score warrants blocking in their environment, considering the IP's classification as a mobile carrier endpoint with no open services.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.