120.26.64.17📋 Copy

# IP Intelligence Briefing: 120.26.64.17/32

## Executive Summary

IP address 120.26.64.17 presents a low-risk profile with a risk score of 25. The address is assigned to ALISOFT (ALIBABA-CN-NET - Hangzhou Alibaba Advertising Co., Ltd.) within the APNIC region and is geolocated to Hangzhou, Zhejiang, China (CN). No active services or open ports were detected; the system appears firewalled. While historical signal observations indicate threat activity (6 pulse events), current network classification shows the subnet as mostly clean with minimal abuse density.

## Profile Overview

• Risk Score: 25 (Low Risk)
• ASN: 37963 (ALISOFT)
• Organization: ALISOFT
• Network Block: 120.24.0.0/14
• Geolocation: China (CN), Zhejiang Province, Hangzhou
• RIR: APNIC
• DNSBL Status: Listed on 1 of 8 DNSBLs
• Service Status: Firewalled / No Services Detected

## Threat Indicators

Historical signal analysis reveals 6 threat pulses associated with this IP address. The IP has been flagged in threat feeds with varying confidence levels (0.22–0.85). DNSBL enumeration confirms listing on at least one blacklist. However, no active attacker indicators, Tor exit node activity, or spam source classification was detected in current observations. The IP is not associated with any known malicious campaigns.

## Network Neighborhood Analysis

The /24 subnet (120.26.64.0/24) containing this IP shows:

• Abuse Density: Minimal (0–1)
• Classification: Mostly Clean
• Active Siblings: 0 detected
• Threat Siblings: 1 identified
• Total Siblings: 1

The neighborhood exhibits low abuse density, suggesting isolated rather than coordinated malicious activity.

## Observed Relationships

Twenty-four relationships were identified, all classified as "Same Network" type, referencing the network name "ALISOFT." This indicates the IP is part of a larger network infrastructure block commonly associated with Alibaba advertising services in China.

## Historical Signal Timeline

Recent observations from June 2026 show:

• ASN 37963 confirmed as "Hangzhou Alibaba Advertising Co., Ltd."
• Geolocation signals consistently point to Hangzhou, ZJ, CN
• Threat signals detected with 0.85 confidence confidence
• Operator score: 0.1304 (Minimal)
• Routing stability: False (route changes observed)

## Recommended Security Actions

Based on the current low-risk profile and lack of actionable threat indicators, no immediate firewall or WAF rules are recommended. However, the following monitoring practices are advised:

1. Passive Monitoring: Continue passive traffic analysis to detect any service changes

2. DNSBL Review: Investigate the reason for the single DNSBL listing

3. Traffic Baseline: Establish normal traffic patterns for this subnet

4. Threat Pulse Review: Analyze the 6 historical threat pulses for context

## Risk Assessment

Current Risk Level: LOW

Threat Level: LOW-MEDIUM

Recommended Action: Monitor, No Immediate Block

The IP presents a low-risk profile with historical threat indicators but no current active malicious behavior. The absence of open services and minimal neighborhood abuse density support continued monitoring rather than immediate blocking. SOC analysts should correlate any traffic from this IP with broader threat intelligence before taking blocking actions.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.