175.170.144.19📋 Copy

# THREAT INTELLIGENCE BRIEFING: IP 175.170.144.19/32

Classification: Moderate Risk (Score: 50/100)

Date: Current Assessment

Status: Active Monitoring Recommended

## OWNERSHIP & INFRASTRUCTURE

IP 175.170.144.19/32 is registered to ChinaUnicom Hostmaster (ASN 4837, Organization: UNICOM-LN), allocated from the 175.160.0.0/12 block under APNIC RIR. The IP is classified as a mobile endpoint operated by China Unicom (MCC 460, MNC 01) using LTE/5G technology. The control plane indicates the IP is part of a stable BGP prefix (175.160.0.0/12) with operator score 0.1304 (Minimal).

## GEOLOCATION

Geolocation data indicates origin in Liaoning Province, P.R. China. The consensus accuracy radius is 2500km. Geovalidation shows the location is not considered plausible with 0 probe count and no violation indicators.

## THREAT PROFILE

• Reputation: Moderate Risk
• Threat Indicators: None explicitly identified
• Known Attacker Status: False
• Spam Source Status: False
• Tor Exit Node: False
• Blacklist Count: 0 (DNSBL: 1 of 8 lists)
• Abuse Confidence: Not scored
• Campaign Association: No matches detected

The IP shows no active threat indicators, is not associated with known malicious campaigns, and has zero explicit threat feed matches. However, one DNSBL listing was detected.

## NETWORK ROLE & SERVICES

The IP is classified as a mobile endpoint with no open services detected. The service purpose is reported as "Firewalled / No Services." No TLS certificates, HTTP banners, or domain associations were observed. DNS resolution is forward-confirmed as false with zero hosted domains and zero forward hostnames.

## NEIGHBORHOOD CONTEXT

The /24 subnet (175.170.144.0/24) contains 4 total sibling IPs with an abuse density of 0. Risk distribution across the subnet: 2 medium-risk neighbors, 1 low-risk neighbor. Identified neighbors include:

• 175.170.144.16 (Risk: 40, Authority: 50)
• 175.170.144.17 (Risk: 65, Authority: 50)
• 175.170.144.18 (Risk: 25, Authority: 50)

All relationships map to the UNICOM-LN network infrastructure.

## OBSERVATION HISTORY

Eighteen signal observations recorded. Recent activity includes operator score assessments (0.30 confidence), geolocation signals (0.52 confidence, CN), and blacklist listing signals (0.85 confidence, high severity). No persistent malicious behavior detected; threat persistence days: 0.

## RECOMMENDED ACTIONS

Based on the moderate risk profile, the following defensive measures are recommended:

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 175.170.144.19 -j DROP

# nftables

nft add rule inet filter input ip saddr 175.170.144.19 drop

```

Application-Level Blocking:

• nginx: `deny 175.170.144.19;`
• pfSense: `175.170.144.19/32`
• Cloudflare WAF: Block with expression `ip.src eq 175.170.144.19`
• AWS WAF: Add `175.170.144.19/32` to address list

## SUMMARY

IP 175.170.144.19/32 represents a moderate-risk mobile endpoint from Chinese telecommunications infrastructure with no active threat indicators. While not currently flagged as malicious, the DNSBL listing and moderate risk score warrant monitoring. The mobile classification and firewalled status suggest limited service exposure. Block or monitor based on organizational risk tolerance.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.