180.103.50.136📋 Copy

# IP Intelligence Briefing: 180.103.50.136/32

Classification: MODERATE RISK | Country: China (CN) | ASN: 4134 (Chinanet Hostmaster)

Generated: 2026-07-29

Status: ACTIVE OBSERVATION

---

## Executive Summary

IP 180.103.50.136 is registered to China Telecom Corp. Ltd. (Chinanet Hostmaster) under CIDR block 180.96.0.0/11. The IP is classified as mobile carrier infrastructure (China Telecom LTE/5G) with no active services or open ports. Current risk assessment is moderate (score: 40/100). No active threat indicators detected. The IP exhibits stable ownership characteristics with no observed malicious persistence.

---

## Technical Profile

Ownership & Geolocation

• Organization: CHINANET-JS (China Telecom)
• ASN: 4134
• Network: CHINANET-JS (180.96.0.0/11)
• Geolocation: China (34.77°N, 113.72°E), Asia/Shanghai timezone
• Registration RIR: APNIC
• Abuse Contact: anti-spam@chinatelecom.cn

Network Characteristics

• Infrastructure Type: Mobile carrier infrastructure
• Mobile Carrier: China Telecom (MCC: 460, MNC: 03)
• Connection Technology: LTE/5G
• Services: Firewalled / No Services Detected
• DNS Status: No PTR records, no forward resolution

---

## Threat Assessment

Risk Metrics

• Overall Risk Score: 40 (Moderate)
• Abuse Confidence: Not applicable (no active abuse signals)
• Blacklist Count: 0
• Threat Persistence: 0 days (not persistently malicious)
• Known Campaigns: None

Threat Indicators

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Vulnerability Scans: None detected

---

## Neighborhood Analysis (180.103.50.0/24)

• Subnet Classification: Clean
• Abuse Density: 0
• Total Siblings: 5
• Active Siblings: 1
• Threat Siblings: 0

Notable Neighbor

• 180.103.50.58: Risk Score 25, Authority Score 50 (elevated within subnet)

---

## Historical Observations

Total Observations: 14 signals

Key Historical Signals:

• Ownership records: Stable (0 changes observed)
• Geolocation: Consistent China-based assignment
• Network classification: Stable mobile carrier designation
• Control plane: Route stable (no route changes in 30 days)

Temporal Analysis: No observed escalation in threat profile over observation period.

---

## Related Entities

• Network Relationships: CHINANET-JS (3 relationship entries)
• No: Associated hostnames, domains, or certificates identified

---

## Recommended Actions

Firewall Rules

```bash

# iptables

iptables -A INPUT -s 180.103.50.136 -j DROP

# nftables

nft add rule inet filter input ip saddr 180.103.50.136 drop

# nginx

deny 180.103.50.136;

# pfSense

180.103.50.136/32

```

Cloud Platform Rules

```json

// Cloudflare WAF

{"description":"Block 180.103.50.136 — IPDebrief risk score 40","action":"block","filter":{"expression":"ip.src eq 180.103.50.136"}}

// AWS WAF

{"Addresses":["180.103.50.136/32"],"Description":"IPDebrief risk 40"}

```

---

## Analyst Notes

This IP represents legitimate mobile carrier infrastructure. The moderate risk score (40) is primarily driven by the mobile carrier classification and geographic origin, rather than active malicious behavior. The subnet shows minimal abuse density with only one low-risk neighbor. No immediate threat indicators warrant urgent action; however, the system-generated block rules provide defense-in-depth for potential future abuse from this mobile IP range.

Recommendation: Monitor but no urgent remediation required. Evaluate against specific threat intelligence context before implementing blocking measures.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.