140.206.235.84
# IP Intelligence Briefing: 140.206.235.84/32
## Executive Summary
IP 140.206.235.84 presents a low-risk profile with minimal threat indicators. The address is geolocated to Shanghai, China (CN) and belongs to AS17621 (Alibaba Cloud). While the IP is firewalled with no active services, it shows DNSBL listings and maintains a low-to-moderate risk score of 25.
## Current Risk Assessment
- Overall Risk Score: 25 (Low Risk)
- Provider/Authority Scores: 0 (no authoritative data)
- Geolocation: China, Shanghai (2500km accuracy radius)
- Network Classification: Cloud infrastructure, firewalled/no services detected
- Origin ASN: AS17621 (140.206.0.0/16 BGP prefix)
## Threat Indicators
- Blacklist Status: Listed on 1 of 8 DNSBL lists with high severity designation
- Threat Feeds: No active threat indicators in feeds
- Malicious Activity: No known campaigns, not a known attacker, not a spam source
- Behavioral Signals: Zero honeypot hits, enumeration strikes, or WAF violations observed
## Network Context
- Subnet (140.206.235.0/24): Low abuse density (0.0), 6 sibling IPs
- Neighbor Risk: 4 neighbors show low risk (score 0), 2 neighbors match this IP's risk profile (score 25)
- Stability: Route stability is false; RPKI state and IRR consistency data unavailable
- DNS Resolution: No PTR records, no forward resolution, no hosted domains
## Historical Observations (8 signals)
Recent monitoring (as of 2026-07-28) shows:
- Geolocation consistently reported as China with 35% confidence
- DNSSEC validation confirmed
- Multiple DNSBL listings observed, including high-severity entries
- No persistent malicious behavior detected
## Relationships
No external relationships detected. The IP lacks connections to related hostnames, organizations, or certificates.
## SOC Recommendations
1. Monitor but do not block: Risk score of 25 indicates low threat. The DNSBL listing warrants awareness but does not justify automatic blocking.
2. Verify cloud context: AS17621 is a major cloud provider; false positives from legitimate cloud traffic are possible.
3. Track DNSBL status: Monitor the 8 DNSBL listings for changes that could increase risk profile.
4. Subnet correlation: Two neighbors (140.206.235.68, 140.206.235.76) share identical risk scoring; investigate if they warrant similar treatment.
5. No immediate action required: No active services, no open ports, and no evidence of malicious activity.
Classification: LOW RISK - Cloud infrastructure address with minimal threat indicators.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | ChinaUnicom Hostmaster |
| ASN | AS17621 |
| Network Name | UNICOM-SH |
| CIDR Block | 140.206.0.0/15 |
| RIR | ARIN |
| Country | CN |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🛡️ Public Network Snapshot
| Origin ASN | AS17621 |
| Network Prefix | 140.206.0.0/16 |
| Route mapping | Found |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 25% | 1 | 1 |
| routing | 25% | 1 | 1 |
| services | 25% | 1 | 1 |
| ownership | 0% | 0 | 0 |
| reputation | 0% | 0 | 0 |
| geolocation | 25% | 1 | 1 |
| Overall | 16% | 4 | 4 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-18 11:33:53 UTC |
| Last Seen | 2026-09-03 01:29:50 UTC |
| Profile Built | 2026-08-31 16:47:56 UTC |
| Data Freshness | Live |
| Signal Types | 17 |
| Total Observations | 19 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 140.206.235.84
Who owns the IP address 140.206.235.84?
140.206.235.84 is registered to ChinaUnicom Hostmaster. The address falls within the 140.206.0.0/15 network block. Registration is held at ARIN.
Where is 140.206.235.84 located?
Geolocation data places 140.206.235.84 in Shanghai, Shanghai, China. The local time zone is Asia/Shanghai. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 140.206.235.84 malicious or safe?
140.206.235.84 currently carries a low risk assessment, meaning no significant threat indicators have been observed. This assessment is generated from continuously collected signals and can change over time.