121.46.239.195📋 Copy

# IP Intelligence Briefing: 121.46.239.195

## Executive Summary

IP address 121.46.239.195 is classified as High Risk (Score: 80) with limited observable network activity. The IP is hosted by AS4811 (ZHAOONE-NET, Yin Liang) within the Chinese APNIC registry. While the /24 subnet shows minimal abuse density, this specific address has been listed on 5 out of 8 DNSBLs. No active services or open ports were detected.

## Ownership and Geolocation

• ASN: 4811
• Organization: ZHAOONE-NET (Yin Liang)
• CIDR Block: 121.46.224.0/19
• Country: CN (China)
• RIR: APNIC
• Registration: Data unavailable

## Network Classification

• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• TLS/HTTP: No certificates or web services observed
• Infrastructure: Not cloud, CDN, VPN, proxy, Tor, or hosting infrastructure

## Threat Indicators

• Risk Score: 80 (High)
• DNSBL Listings: 5 of 8 total lists
• Known Campaigns: None
• Tor Exit Node: No
• Spam Source: No
• Known Attacker: No
• Abuse Confidence Score: Not available

## Neighborhood Analysis

The /24 subnet (121.46.239.0/24) contains 9 sibling IPs with the following distribution:

• High Risk: 0
• Medium Risk: 0
• Low Risk: 5
• Abuse Density: 0
• Threat Siblings: 0

Most neighbors (6 IPs) show authorityScore of 50, suggesting legitimate infrastructure. The target IP is the only one with elevated risk classification within this subnet.

## Signal History

Fifteen observations recorded with latest activity from 2026-07-27:

• Geolocation: China (35.86°N, 104.2°E) with 2,500km accuracy radius
• ICMP: Blocked - unable to validate
• Ownership Changes: 0
• Threat Persistence: 0 days
• Persistently Malicious: False

## Operational Context

• BGP Prefix: 121.46.239.0/24
• Route Stability: False (isRouteStable: false)
• RPKI State: Not validated
• Delegation Age: Not available
• RTT: 30 hops, 0.2ms first hop

## Recommended Actions

• Monitor for changes in DNSBL listing status
• No immediate blocking recommended without additional context
• Consider correlation with other threat intel feeds

## Intelligence Assessment

This IP presents a moderate threat profile. The high risk score appears driven by DNSBL listings rather than active attack patterns. The lack of open ports and services suggests the IP may be used for outbound connections or command-and-control activity rather than hosting services. The clean neighborhood environment suggests the threat is isolated to this specific address. SOC teams should monitor for changes in behavior patterns and correlate with incident data to determine if blocking is warranted.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.