121.29.4.103📋 Copy

# IP Intelligence Briefing: 121.29.4.103/32

Classification: Moderate Risk | Jurisdiction: China (CN) | Provider: ChinaUnicom Hostmaster

---

## Executive Summary

IP 121.29.4.103 is a Chinese mobile network endpoint associated with China Unicom Hostmaster (ASN 4837). The address carries a moderate risk score of 40/100 and is firewalled with no active services. The IP is listed on 2 of 8 DNSBL feeds and originates from Beijing, China. Neighborhood analysis indicates high-abuse classification within the /24 subnet with 5 threat siblings and 62.5% abuse density.

---

## Technical Profile

Ownership & Registration:

• ASN: 4837 (ChinaUnicom Hostmaster)
• Netname: UNICOM-HE
• CIDR Block: 121.28.0.0/15
• RIR: APNIC
• Abuse Contact: Available via RDAP

Geolocation:

• Country: China (CN)
• Region/City: Beijing
• Accuracy Radius: 2,500km
• Geo Consensus: Validated

Network Classification:

• Mobile Carrier: China Unicom (MCC: 460, MNC: 01)
• Connection Technology: LTE/5G
• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• DNS Resolution: No PTR records; forward resolution inactive

---

## Threat Indicators

Blacklist Status:

• DNSBL Listed: 2/8 total lists
• Abuse Confidence Score: Not reported
• Threat Feeds: None correlated
• Known Campaigns: None identified

Campaign Intelligence:

• Likelihood: Not assessed
• CERT Matches: 0
• Correlated IPs: 0

---

## Historical Observations

Analysis of 18 observations reveals temporal activity with two primary observation periods:

June 17, 2026:

• DNSSEC validation: Invalid
• DNS record zone: 103.4.29.121.in-addr.arpa
• Geolocation signals: Confirmed China origin
• Blacklist activity: Listed on multiple feeds with "high" severity

June 22, 2026:

• Operator score: 0.1304 (Minimal)
• Routing signals: Multiple dimensions covered
• Overall confidence: 0.21

The IP shows persistent monitoring with no significant escalation in threat posture.

---

## Neighborhood Analysis

Subnet: 121.29.4.103/24

• Total Siblings: 8
• Active Siblings: 1
• Threat Siblings: 5
• Abuse Density: 0.625 (High)
• Inherited Risk Score: 12

Neighbor Risk Distribution:

• High Risk: 0
• Medium Risk: 6
• Low Risk: 1

Notable Neighbors (Risk Score 40/100):

• 121.29.4.46, 121.29.4.74, 121.29.4.79, 121.29.4.80, 121.29.4.85, 121.29.4.251

The subnet exhibits elevated abuse activity with 62.5% abuse density. Multiple neighbors share similar risk profiles, suggesting coordinated or shared infrastructure usage.

---

## Recommended Actions

Firewall/Block Recommendations:

• Monitor incoming traffic from 121.29.4.0/24
• Apply rate limiting for mobile carrier traffic (China Unicom)
• No immediate blocking required due to moderate risk score (40)

Monitoring Priorities:

• Watch for service activation on currently firewalled IP
• Monitor DNSBL listing changes
• Track subnet-level activity patterns

MITRE ATT&CK Context:

• No specific TTPs identified
• Risk profile aligns with infrastructure-level monitoring requirements

---

Intelligence Freshness: Current as of June 2026 | Next Review: Quarterly or upon service activation

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.