# 121.46.239.195 — IP Intelligence Summary

121.46.239.195 is an IPv4 address operated by Yin Liang (AS4811), geolocated to China. As of October 16, 2026, IPDebrief rates it High Risk (80/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/121.46.239.195
- Last updated: 2026-10-16

## Ownership

- Organization: Yin Liang
- Network name: ZHAOONE-NET
- Allocated block: 121.46.224.0/19
- ASN: AS4811 (https://ipdebrief.com/asn/4811)
- Regional registry: APNIC

## Location

- City: —
- Region: —
- Country: China
- Time zone: —

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: High Risk (80/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP Intelligence Briefing: 121.46.239.195

\## Executive Summary

IP address 121.46.239.195 is classified as **High Risk (Score: 80)** with limited observable network activity. The IP is hosted by AS4811 (ZHAOONE-NET, Yin Liang) within the Chinese APNIC registry. While the /24 subnet shows minimal abuse density, this specific address has been listed on 5 out of 8 DNSBLs. No active services or open ports were detected.

\## Ownership and Geolocation

\- **ASN**: 4811

\- **Organization**: ZHAOONE-NET (Yin Liang)

\- **CIDR Block**: 121.46.224.0/19

\- **Country**: CN (China)

\- **RIR**: APNIC

\- **Registration**: Data unavailable

\## Network Classification

\- **Service Purpose**: Firewalled / No Services

\- **Open Ports**: None detected

\- **TLS/HTTP**: No certificates or web services observed

\- **Infrastructure**: Not cloud, CDN, VPN, proxy, Tor, or hosting infrastructure

\## Threat Indicators

\- **Risk Score**: 80 (High)

\- **DNSBL Listings**: 5 of 8 total lists

\- **Known Campaigns**: None

\- **Tor Exit Node**: No

\- **Spam Source**: No

\- **Known Attacker**: No

\- **Abuse Confidence Score**: Not available

\## Neighborhood Analysis

The /24 subnet (121.46.239.0/24) contains 9 sibling IPs with the following distribution:

\- **High Risk**: 0

\- **Medium Risk**: 0

\- **Low Risk**: 5

\- **Abuse Density**: 0

\- **Threat Siblings**: 0

Most neighbors (6 IPs) show authorityScore of 50, suggesting legitimate infrastructure. The target IP is the only one with elevated risk classification within this subnet.

\## Signal History

Fifteen observations recorded with latest activity from 2026-07-27:

\- **Geolocation**: China (35.86°N, 104.2°E) with 2,500km accuracy radius

\- **ICMP**: Blocked - unable to validate

\- **Ownership Changes**: 0

\- **Threat Persistence**: 0 days

\- **Persistently Malicious**: False

\## Operational Context

\- **BGP Prefix**: 121.46.239.0/24

\- **Route Stability**: False (isRouteStable: false)

\- **RPKI State**: Not validated

\- **Delegation Age**: Not available

\- **RTT**: 30 hops, 0.2ms first hop

\## Recommended Actions

\- Monitor for changes in DNSBL listing status

\- No immediate blocking recommended without additional context

\- Consider correlation with other threat intel feeds

\## Intelligence Assessment

This IP presents a moderate threat profile. The high risk score appears driven by DNSBL listings rather than active attack patterns. The lack of open ports and services suggests the IP may be used for outbound connections or command-and-control activity rather than hosting services. The clean neighborhood environment suggests the threat is isolated to this specific address. SOC teams should monitor for changes in behavior patterns and correlate with incident data to determine if blocking is warranted.

## Nearby addresses

- 121.46.239.196 (https://ipdebrief.com/121.46.239.196)
- 121.46.239.197 (https://ipdebrief.com/121.46.239.197)
- 121.46.239.198 (https://ipdebrief.com/121.46.239.198)
- 121.46.239.199 (https://ipdebrief.com/121.46.239.199)
- 121.46.239.200 (https://ipdebrief.com/121.46.239.200)
- 121.46.239.201 (https://ipdebrief.com/121.46.239.201)
- 121.46.239.202 (https://ipdebrief.com/121.46.239.202)
- 121.46.239.203 (https://ipdebrief.com/121.46.239.203)
- 121.46.239.204 (https://ipdebrief.com/121.46.239.204)
- 121.46.239.208 (https://ipdebrief.com/121.46.239.208)
- 121.46.239.213 (https://ipdebrief.com/121.46.239.213)
- 121.46.239.215 (https://ipdebrief.com/121.46.239.215)

---

Source: IPDebrief, "121.46.239.195 IP intelligence", https://ipdebrief.com/121.46.239.195, updated 2026-10-16. Assessments are probabilistic.