123.57.73.112📋 Copy

# INTELLIGENCE BRIEFING: IP 123.57.73.112

Classification: Moderate Risk (Risk Score: 50)

Date: 2026-06-25

Report ID: IP-1235773112-20260625

---

## EXECUTIVE SUMMARY

IP address 123.57.73.112 presents a moderate risk profile with a risk score of 50. The address is geolocated to Beijing, China, and is associated with ASN 37963 (ALISOFT). No active threat indicators were detected during profile analysis, but the moderate risk classification warrants defensive monitoring.

---

## OWNERSHIP & NETWORK CLASSIFICATION

Network Role: Firewalled / No Services

Infrastructure Type: Not cloud, not CDN, not VPN, not proxy, not hosting infrastructure

---

## THREAT ASSESSMENT

Overall Risk Score: 50 (Moderate Risk)

Abuse Confidence Score: Not available

Blacklist Status: Not listed on threat feeds

Tor Exit Node: No

Known Attacker: No

Spam Source: No

Threat Indicators: None detected

Known Campaigns: None associated

DNSBL Listings: 2 out of 8 total lists

---

## OBSERVATION HISTORY

The IP has been observed across 15 signal observations spanning multiple dates. Key observations include:

• 2026-06-25: Multiple signals observed with confidence levels ranging from 0.21 to 0.30, including reputation (Minimal), routing, services, ownership, and geolocation assessments.
• 2026-06-04: ASN 37963 resolution with prefix 123.56.0.0/15, confirming Alibaba China Network origin. Network classification signals confirmed non-cloud, non-Tor, non-proxy status.
• Service Scanning: Port scans conducted on 2026-06-04 with no open ports detected.

Threat Persistence: 0 days

Ownership Changes: 0

Persistent Malicious Activity: False

---

## RELATIONSHIP ANALYSIS

The IP exhibits 15 relationships, all classified as "Same Network" pointing to the ALISOFT network infrastructure. This indicates the IP operates within a larger network block with consistent network classification. No external entity relationships (hostnames, certificates, organizations outside the network) were identified.

---

## NEIGHBORHOOD ANALYSIS

Subnet: 123.57.73.112/24

Abuse Density: 0 (Low)

Classification: Mostly Clean

Total Siblings: 1

Active Siblings: 0

Threat Siblings: 1

The neighboring subnet shows low abuse density with minimal threat concentration, suggesting this IP does not operate in a highly compromised network environment.

---

## CONTROL PLANE DATA

• Origin ASN: 37963
• BGP Prefix: 123.56.0.0/15
• Route Stability: Unstable (isRouteStable: false)
• Route Changes (30d): 0
• MOAS: False
• DNSSEC Valid: True
• HAS CAA: False
• Operator Score: 0.1304 (Minimal)
• DNSBL Listed Count: 2

---

## RECOMMENDED ACTIONS

Based on the moderate risk profile, the following defensive measures are recommended:

Firewall Rules

Priority Assessment

Immediate Action: Recommended blocking due to moderate risk score

Monitoring: Continue surveillance for threat indicator emergence

Context: IP appears dormant with no open services; blocking is precautionary

---

## ANALYST NOTES

This IP address presents a moderate risk profile without active malicious indicators. The moderate risk score (50) suggests defensive caution is warranted. The absence of open services and threat indicators indicates the IP may be dormant or part of a larger network infrastructure. Continued monitoring is recommended, particularly given the moderate risk classification and the presence of 2 DNSBL listings. The low abuse density in the neighboring subnet provides context that this IP is not operating in a highly compromised network environment.

---

Report Generated: 2026-06-25

Data Sources: IPDebrief Intelligence Platform

Classification: SOC Analyst Briefing

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.