139.189.114.113📋 Copy

IP INTELLIGENCE BRIEFING: 139.189.114.113/32

Classification: High Risk | Risk Score: 80/100 | Country: China (CN)

---

EXECUTIVE SUMMARY

IP address 139.189.114.113 is classified as High Risk with a score of 80/100. The address is associated with China Telecom mobile infrastructure and is listed on 5 of 8 DNS blacklists. Despite the elevated risk classification, no active threat indicators (malware, scanning, or campaign activity) were detected in the profile. The IP is currently firewalled with no open services or ports.

---

OWNERSHIP AND GEOSPATIAL DATA

• ASN: 4134 (IRT-CHINANET-HI / CHINANET)
• Organization: IRT-CHINANET-HI, CHINANET
• Registration RIR: ARIN
• Network Block: 139.189.0.0/17
• Geolocation: NanHai Avenue, HaiKou, China (CN)
• Mobile Carrier: China Telecom Corp. Ltd. (MCC: 460, MNC: 03)
• Connection Technology: LTE/5G

---

NETWORK CLASSIFICATION

• Infrastructure Type: Mobile device traffic
• Service Status: Firewalled / No Services
• Tor Exit: No
• Known Attacker: No
• Spam Source: No
• Cloud/CDN/Proxy/VPN: No

---

THREAT INTELLIGENCE

• DNSBL Listings: 5 of 8 total blacklists (dnsblListedCount: 5)
• Abuse Confidence Score: Not available
• Threat Indicators: None detected
• Known Campaigns: None
• Threat Feeds: No matches

---

OBSERVATION HISTORY

• Total Observations: 11 signals recorded
• Most Recent Activity: 2026-07-31
• Ownership Stability: Stable (0 ownership changes)
• Threat Persistence: 0 days
• Persistently Malicious: No
• Signal Types Observed: Ownership records, DNS resolution, port scanning attempts

The IP has maintained consistent ownership without significant changes. Recent observations include port scanning activity and ownership confirmation from Chinese infrastructure registries.

---

NETWORK RELATIONSHIPS

• Primary Relationship: Same Network (CHINANET)
• Associated Hostnames: None
• Linked Certificates: None
• Related Organizations: None beyond network-level association

---

NEIGHBORHOOD ANALYSIS

• Subnet: 139.189.114.113/24
• Abuse Density: 0
• Total Neighbors: 0
• Threat Siblings: 0
• Inherited Risk: 0

The /24 subnet shows no adjacent threat activity, indicating this IP's risk classification is likely IP-specific rather than subnet-wide.

---

CONTROL PLANE DATA

• BGP Prefix: 139.189.0.0/16
• Origin ASN: 4134
• Route Stability: Unstable (isRouteStable: false)
• RPKI State: Not assessed
• Delegation Age: Not available
• Route Changes (30d): 0

---

RECOMMENDED ACTIONS

Immediate Actions:

1. Increase Logging: Enable enhanced logging verbosity for this IP to review recent activity patterns

2. Firewall Implementation: Consider blocking or rate-limiting based on threat context

Firewall Rules Provided:

• iptables: `iptables -A INPUT -s 139.189.114.113 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 139.189.114.113 drop`
• nginx: `deny 139.189.114.113;`
• pfSense: `139.189.114.113/32`
• Cloudflare WAF: Block with expression `ip.src eq 139.189.114.113`
• AWS WAF: Add to blocklist with description "IPDebrief risk 80"

---

ANALYST NOTES

This IP presents elevated risk (80/100) primarily due to DNS blacklist associations and mobile carrier classification. However, the absence of active threat indicators, open services, or sustained malicious behavior suggests limited immediate threat. The high-risk classification may stem from historical blacklist entries or association with mobile infrastructure commonly used in various threat contexts.

Recommended SOC Handling: Monitor traffic patterns from this IP. If no legitimate business activity is observed, consider implementing rate limiting or temporary blocking. The mobile carrier origin may indicate user-initiated traffic rather than automated botnet activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.