14.103.111.171
## Threat Intelligence Briefing: 14.103.111.171
Executive Summary
IP address 14.103.111.171 is associated with China Telecom's CHINANET-SHANGHAI-MAN network (ASN 4811) under the VOLCANO-ENGINE network block. The IP presents a low-risk profile (risk score 25) with no active threat indicators, though it is listed on one of eight DNSBL feeds with high-severity classification.
Technical Profile
Network Assignment: 14.103.0.0/16, VOLCANO-ENGINE network
ISP/Provider: CHINANET-SHANGHAI-MAN (China Telecom Group)
Geolocation: China (CN), consensus geolocation with 2,500km accuracy radius
Network Role: Firewalled / No Services Detected
Cloud/CDN/Proxy Status: None detected
Risk Assessment
The IP exhibits a risk score of 25 (Low Risk) with the following characteristics:
- Threat Indicators: None detected
- Blacklist Status: Listed on 1 of 8 DNSBL feeds (high severity)
- Known Attacker Status: False
- Tor Exit Node: False
- Spam Source: False
- Service Exposure: No open ports detected; no TLS certificates or HTTP services
- Route Stability: Unstable (route changes observed in last 30 days)
- Persistence: Not persistently malicious (threat observation count: 0)
Observational History
Recent signal observations (July 22, 2026) indicate:
- Geolocation inference for China with multi-signal validation
- DNSSEC validation confirmed (true)
- PTR record resolution failed
- 8 DNSBL listings with 1 active high-severity listing
- ASN and prefix validation via Cymru DNS
Neighborhood Analysis
The /24 subnet (14.103.111.0/24) contains 7 sibling IPs with the following risk distribution:
- High Risk: 0
- Medium Risk: 5 (14.103.111.13, 16, 127, 135, 162, 167 all scored 50)
- Low Risk: 2 (14.103.111.110, 171 scored 25)
- Abuse Density: 0
The subnet shows elevated medium-risk activity across multiple IP addresses.
Relationship Graph
Network relationships identified only within the VOLCANO-ENGINE network block. No associations to external organizations, hostnames, or certificates observed.
Recommended Actions
No immediate blocking recommended. The IP presents low-risk characteristics with no active threat indicators, though:
1. Monitor for changes in blacklist status
2. Consider geo-filtering if policy restricts China-bound traffic
3. Observe subnet for coordinated activity given multiple medium-risk neighbors
No firewall rules or WAF configurations required at this time.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | IRT-VOLCANO-ENGINE-CN |
| ASN | AS4811 |
| Network Name | VOLCANO-ENGINE |
| CIDR Block | 14.103.0.0/16 |
| RIR | APNIC |
| Country | CN |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🛡️ Public Network Snapshot
| Origin ASN | AS4811 |
| Network Prefix | 14.103.104.0/21 |
| Route mapping | Found |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 0% | 0 | 0 |
| routing | 0% | 0 | 0 |
| services | 0% | 0 | 0 |
| ownership | 50% | 2 | 3 |
| reputation | 0% | 0 | 0 |
| geolocation | 25% | 1 | 1 |
| Overall | 12% | 3 | 4 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-02 04:20:56 UTC |
| Last Seen | 2026-09-29 03:06:15 UTC |
| Profile Built | 2026-09-13 04:46:20 UTC |
| Data Freshness | Live |
| Signal Types | 18 |
| Total Observations | 20 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 14.103.111.171
Who owns the IP address 14.103.111.171?
14.103.111.171 is registered to IRT-VOLCANO-ENGINE-CN. The address falls within the 14.103.0.0/16 network block. Registration is held at APNIC.
Where is 14.103.111.171 located?
Geolocation data places 14.103.111.171 in China. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 14.103.111.171 malicious or safe?
14.103.111.171 currently carries a moderate risk assessment, meaning some indicators warrant caution, but the evidence is mixed. This assessment is generated from continuously collected signals and can change over time.