# 124.117.195.6 — IP Intelligence Summary

124.117.195.6 is an IPv4 address operated by IRT-CHINANET-CN (AS4134), geolocated to HUANG HE ROAD 30, China. It belongs to a mobile network. As of October 6, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/124.117.195.6
- Last updated: 2026-10-06

## Ownership

- Organization: IRT-CHINANET-CN
- Network name: CHINANET-XJ
- Allocated block: 124.117.0.0/16
- ASN: AS4134 (https://ipdebrief.com/asn/4134)
- Regional registry: APNIC

## Location

- City: HUANG HE ROAD 30
- Region: —
- Country: China
- Time zone: —

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: yes
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (40/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP Intelligence Briefing: 124.117.195.6

\## Executive Summary

IP address 124.117.195.6 is classified as **Moderate Risk** (score: 40) and originates from China Telecom's mobile infrastructure within the CHINANET-XJ network. The IP is associated with residential mobile connectivity and demonstrates no active threat indicators. The IP is listed on 2 DNSBLs but shows no evidence of persistent malicious activity.

\## Ownership and Network Infrastructure

| Attribute | Value |

|-----------|-------|

| ASN | 4134 |

| Organization | Chinanet Hostmaster |

| Network | CHINANET-XJ (124.117.0.0/16) |

| RIR | APNIC |

| Country | China (CN) |

| Region | HUANG HE ROAD 30 |

| Mobile Carrier | China Telecom (MCC: 460, MNC: 03) |

\## Threat Assessment

**Current Status:** Moderate Risk (40/100)

**Threat Indicators:**

\- No active threat indicators detected

\- Not identified as Tor exit node

\- Not flagged as known attacker

\- Not identified as spam source

\- No associated threat campaigns

\- 0 direct blacklist hits; 2 DNSBL listings recorded

**Network Role:**

\- Infrastructure Type: Mobile/Residential

\- Service Status: Firewalled / No Services

\- No open ports detected

\- No TLS certificates or HTTP services active

\## Geolocation and Connectivity

\- **Country:** China (CN)

\- **Coordinates:** 35.86°N, 104.20°E (2,500km accuracy radius)

\- **Connection Type:** LTE/5G mobile network

\- **Geolocation Consensus:** True (1 source)

\- **Geo Validation:** Flagged as implausible (2,500km accuracy suggests mobile network reporting limitations)

\## Observation History (11 Signals)

Recent observations dated 2026-07-28 indicate:

\- Consistent ownership attribution to Chinanet Hostmaster

\- No ownership changes detected

\- Threat persistence: 0 days

\- No persistent malicious activity flagged

\- Operator score: 0.1304 (Minimal)

Signal confidence ranges from 0.30 to 0.95 across ownership, geolocation, and control plane attributes.

\## Neighborhood Analysis (124.117.195.0/24)

\- **Total Subnet Siblings:** 49

\- **Active Siblings:** 23

\- **Abuse Density:** 0.0816 (8.16%)

\- **Classification:** Mostly Clean

\- **Inherited Risk:** 3

**Risk Distribution:**

\- High Risk: 0

\- Medium Risk: 11

\- Low Risk: 34

Notable neighboring IPs include 124.117.195.4, 124.117.195.15, and 124.117.195.0, all showing risk scores between 15-40, consistent with the broader mobile/residential nature of the subnet.

\## Recommended Security Actions

Given the moderate risk classification and mobile residential origin, the following actions are recommended:

**Blocking Rules:**

\- **iptables:** \`iptables -A INPUT -s 124.117.195.6 -j DROP\`

\- **nftables:** \`nft add rule inet filter input ip saddr 124.117.195.6 drop\`

\- **nginx:** \`deny 124.117.195.6;\`

\- **pfSense:** \`124.117.195.6/32\`

**Cloud Provider Configuration:**

\- **Cloudflare WAF:** Block with expression \`ip.src eq 124.117.195.6\`

\- **AWS WAF:** Add \`124.117.195.6/32\` to rule set with description "IPDebrief risk 40"

\## Intelligence Assessment

The IP address represents a mobile residential connection from China Telecom's infrastructure. The moderate risk score primarily reflects DNSBL listings and geographic origin rather than active malicious behavior. No evidence of scanning, exploitation attempts, or command-and-control activity was observed. The subnet shows low-to-moderate abuse density, with the majority of sibling IPs classified as low-risk.

**Recommended Action:** Monitor with enhanced logging; consider blocking at perimeter if consistent with organizational security policy for Chinese mobile IP ranges. The lack of active services and persistent malicious activity suggests limited operational risk, though the mobile residential nature may correlate with certain attack vectors.

## Nearby addresses

- 124.117.195.0 (https://ipdebrief.com/124.117.195.0)
- 124.117.195.2 (https://ipdebrief.com/124.117.195.2)
- 124.117.195.4 (https://ipdebrief.com/124.117.195.4)
- 124.117.195.11 (https://ipdebrief.com/124.117.195.11)
- 124.117.195.12 (https://ipdebrief.com/124.117.195.12)
- 124.117.195.15 (https://ipdebrief.com/124.117.195.15)
- 124.117.195.17 (https://ipdebrief.com/124.117.195.17)
- 124.117.195.18 (https://ipdebrief.com/124.117.195.18)
- 124.117.195.19 (https://ipdebrief.com/124.117.195.19)
- 124.117.195.21 (https://ipdebrief.com/124.117.195.21)
- 124.117.195.22 (https://ipdebrief.com/124.117.195.22)
- 124.117.195.24 (https://ipdebrief.com/124.117.195.24)

---

Source: IPDebrief, "124.117.195.6 IP intelligence", https://ipdebrief.com/124.117.195.6, updated 2026-10-06. Assessments are probabilistic.