120.52.92.118📋 Copy

# IP Intelligence Briefing: 120.52.92.118/32

## Executive Summary

IP address 120.52.92.118 presents moderate risk (Score: 55) with no active services detected. The IP belongs to Xin Xing (ASN 133119) within the CU-CDC network block (120.52.0.0/16) in China. No active threat indicators or campaign affiliations observed.

---

## Network Ownership & Classification

Classification:

• Service Purpose: Firewalled / No Services
• Provider/Infrastructure Type: Not classified as CDN, cloud, proxy, VPN, or hosting
• Not a known Tor exit node or residential IP

---

## Risk Assessment

Overall Risk Score: 55 (Moderate Risk)

Control Plane Indicators:

• BGP Prefix: 120.52.0.0/17
• Route Stability: Unstable
• DNSSEC Valid: Yes
• DNSBL Listings: 3 out of 8 total lists
• Operator Score: 0.1304 (Minimal)

Threat Indicators:

• Active Attacker: No
• Known Campaign: No
• Spam Source: No
• Blacklist Count: 0
• Pulsedive Risk: Not applicable

---

## Geolocation Data

---

## Network Services & DNS

Open Ports: None detected

TLS Certificates: None

HTTP Services: None

PTR Resolution: None

Forward Resolution: None

Email Authentication: SPF/DMARC not configured

---

## Observation History Analysis

13 observations recorded. Key temporal patterns:

• Most Recent (2026-07-26): Multi-signal inference confirmed Chinese geolocation with medium confidence (0.52)
• Ownership Signals: APNIC registry assignment confirmed with high confidence (0.90-0.95)
• Service Scans: Ports scanned with no open services detected
• Stability: No ownership changes, zero threat persistence days
• Behavioral: No honeypot hits, no enumeration strikes, no WAF violations

The IP demonstrates stable ownership characteristics with no persistent malicious activity patterns.

---

## Relationship Graph

Two relationships identified:

• Same Network: CU-CDC (network-level association)

No cross-entity links to hostnames, organizations, or certificates detected.

---

## Neighborhood Analysis (120.52.92.0/24)

Subnet Summary:

• Total Neighbors: 18
• Abuse Density: 0
• Risk Distribution: 0 High, 2 Medium, 14 Low

Notable Risk Neighbors:

Subnet-level abuse density remains low (0), indicating the target IP is not part of a broadly compromised subnet.

---

## Recommended Actions

Monitoring:

• Monitor for service activation (ports opening)
• Track DNSBL listing changes
• Watch for geolocation inconsistencies

Blocking Decision:

• Current risk profile does not warrant immediate blocking
• Medium risk score (55) without active threat indicators suggests allow-listing with monitoring

Firewall Rules:

• No specific block rules recommended at this time
• Consider logging all traffic for baseline establishment
• Add to watchlist if service banners appear

---

## Threat Intelligence Conclusion

120.52.92.118 is a Chinese-origin IP (ASN 133119/Xin Xing) presenting moderate risk with no active malicious indicators. The IP is firewalled with no open services, suggesting legitimate infrastructure use. No correlation to known attack campaigns or threat actor infrastructure. Neighborhood analysis confirms low subnet-level abuse density. Recommendation: Monitor with standard logging; no immediate defensive action required.

---

*Report Generated: IPDebrief Intelligence Analysis Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.