124.117.194.189📋 Copy

# IP Intelligence Briefing: 124.117.194.189/32

Date: 2026-07-29

Classification: Low Risk / Mobile Network

Status: Active Monitoring Recommended

---

## Executive Summary

IP address 124.117.194.189 operates within CHINANET-XJ (ASN 4134) mobile network infrastructure in China. The IP presents as a residential/mobile endpoint with no open services, currently showing a low risk score of 25. Recent observations indicate presence on 8 DNSBL lists with one high-severity listing detected.

---

## Ownership & Infrastructure

• ASN: 4134 (CHINANET Hostmaster)
• Organization: Chinanet Hostmaster / CHINANET-XJ
• CIDR Block: 124.117.0.0/16
• Geolocation: China (CN) - Huang He Road 30 (34.77°N, 113.72°E)
• Mobile Carrier: China Telecom (MCC: 460, MNC: 03)
• Connection Type: LTE/5G Mobile Network

---

## Risk Assessment

---

## Threat Indicators

• DNSBL Listings: 8 total lists (1 currently listed)
• Maximum Severity: High
• Threat Indicators: None detected
• Associated Campaigns: None identified
• Blacklist Count: 0 (DNSBL only)

---

## Network Behavior

• Services: No open ports detected
• DNS: No PTR hostnames, no forward resolution
• HTTP/HTTPS: No TLS certificate, no web service
• Mobile: Yes (residential/mobile classification)
• Route Stability: Unstable routing history

---

## Historical Activity

15 observations recorded. Recent signals (2026-07-29) show:

• Geolocation signals from alienvault-otx with threat indicators present (pulse count: 4)
• ICMP validation blocked (geolocation plausible: true)
• DNS resolution observed (zone: 189.194.117.124.in-addr.arpa)
• ASN attribution: CHINANET-BACKBONE from multiple sources

---

## Neighborhood Context (124.117.194.0/24)

• Subnet Classification: Mostly clean
• Abuse Density: 0.0938 (9.38%)
• Total Siblings: 64
• Active Siblings: 21
• Threat Siblings: 6
• Risk Distribution: High: 0, Medium: 18, Low: 43
• Inherited Risk: 3

Sample neighbor risk scores range from 0-30, indicating mixed but predominantly low-risk environment.

---

## Relationships

• Limited relationship graph (2 entries)
• Associated with CHINANET-XJ network
• No organizational or certificate relationships detected

---

## Recommended Actions

1. Monitor: Track continued DNSBL listing status

2. Block: Consider blocking if inbound connection attempts detected

3. Allow: Permissible for mobile/residential traffic if legitimate use case exists

4. Investigate: Review associated 6 threat siblings in /24 subnet for correlated activity

---

## Intelligence Notes

This IP represents standard mobile network infrastructure from China Telecom's CHINANET backbone. The single high-severity DNSBL listing warrants monitoring but does not indicate confirmed malicious activity. The mobile classification and lack of open services suggest legitimate consumer or business mobile endpoint usage. Focus investigation on the 6 threat-adjacent IPs in the same /24 subnet for potential correlation analysis.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.