14.103.114.197📋 Copy

# IPDebrief Intelligence Briefing: 14.103.114.197/32

Classification: Moderate Risk | Date: 2026-06-17 | Analysis: Complete

## Executive Summary

IP address 14.103.114.197 is a Chinese-originating IP from China Telecom (ASN 4811) with a moderate risk score of 40. The IP operates within a high-abuse subnet (14.103.114.0/24) showing 66.7% abuse density and 16 confirmed threat siblings. No active services or open ports are detected. Recommended action: Block at perimeter.

## Key Intelligence Indicators

Risk Profile:

• Risk Score: 40 (Moderate)
• Provider Score: 0 | Authority Score: 0 | Stability Score: 0
• DNSBL Listed: 1 of 8 total lists
• No Tor exit, known attacker, or spam source indicators

Network Attribution:

• ASN: 4811 (CHINANET-SHANGHAI-MAN)
• Organization: IRT-VOLCANO-ENGINE-CN
• BGP Prefix: 14.103.112.0/21
• RIR: APNIC (China)
• Geolocation: China (CN), inferred coordinates 35.86, 104.2 (2500km accuracy)

Network Context:

• Subnet Classification: high_abuse
• Subnet Abuse Density: 66.67%
• Threat Siblings in /24: 16 of 24 addresses
• All neighbors rated medium-to-high risk (scores 40-50)

Service & Host Analysis:

• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• TLS Certificate: None
• DNS PTR Resolution: None
• Forward Resolution: None
• No hosted domains or email infrastructure

## Threat Observations

• Zero active threat indicators detected
• No known campaigns associated
• No threat feeds flagged
• Zero honeypot hits or enumeration strikes recorded
• Historical persistence: 0 threat observation days

Behavioral Note: ICMP validation blocked, unable to confirm physical location. Geolocation derived from multi-signal inference with 52% confidence.

## Historical Trend Analysis

18 observations recorded. Most recent activity on 2026-06-17 at 10:39 UTC. No ownership changes detected. Subnet abuse classification consistent across observations.

## Network Relationships

23 relationships identified, all classified as "Same Network" with target value VOLCANO-ENGINE. No hostname or certificate relationships detected.

## Recommended Security Actions

Based on risk profile, the following rules are recommended:

Firewall Blocking:

```

iptables -A INPUT -s 14.103.114.197 -j DROP

nft add rule inet filter input ip saddr 14.103.114.197 drop

```

Application-Level:

• nginx: `deny 14.103.114.197;`
• pfSense: 14.103.114.197/32
• Cloudflare WAF: Block with expression `ip.src eq 14.103.114.197`
• AWS WAF: Addresses [14.103.114.197/32]

Note: Recommendations are probabilistic and should be combined with additional contextual signals before enforcement.

## SOC Analyst Guidance

1. Immediate Action: Block at perimeter firewall or WAF level due to high-abuse subnet classification

2. Context: Subnet shows elevated risk density; consider subnet-level blocking if threat correlation exists

3. Monitoring: No active threat indicators but monitor for service emergence or reputation degradation

4. False Positive Risk: Moderate - IP may be legitimate but originates from high-risk infrastructure

Confidence Level: Medium - Based on subnet-level risk indicators and historical abuse patterns

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.