183.239.20.236📋 Copy

# THREAT INTELLIGENCE BRIEFING

Target IP: 183.239.20.236/32

Classification: HIGH RISK

Report Date: Current Analysis

## EXECUTIVE SUMMARY

IP 183.239.20.236 is classified as HIGH RISK with a risk score of 80. The address is associated with China Mobile's LTE/5G mobile network infrastructure and operates within the CMNET network (ASN 9808). Recent observation data indicates active blacklist presence with high-severity listings.

## NETWORK ATTRIBUTES

## THREAT INDICATORS

• Risk Score: 80 (High Risk)
• DNSBL Listings: 6 of 8 total lists
• Abuse Confidence Score: Listed on threat feeds
• Tor Exit Node: No
• Known Attacker Status: Not flagged
• Spam Source: No

## OBSERVATION HISTORY

Analysis of 19 historical observations reveals:

• Latest Signal (2026-06-25): High-severity blacklist listings detected with 8 total listings and maximum severity level "high"
• Route Stability: Inconsistent BGP routing (isRouteStable: false)
• DNSSEC Validation: Valid
• Geographic Confidence: 52% confidence in China location via multi-signal inference

## NETWORK CONTEXT

The IP resides within the 183.239.20.236/24 subnet. Relationship analysis shows 17 connections to the CMNET network infrastructure. The subnet classification indicates "mostly_clean" with inherited risk score of 2, though the individual IP maintains a high-risk profile due to blacklist activity.

## RECOMMENDED ACTIONS

1. Block at perimeter - Implement iptables/nftables DROP rule for this IP

2. Monitor DNS queries - Track any DNS resolution attempts to this address

3. Review firewall logs - Check for any connection attempts from or to this IP

4. Update threat intelligence feeds - Ensure blacklist data is current for this IP

## ANALYST NOTES

This IP represents a mobile network endpoint with active threat intelligence flags. The high risk score combined with multiple blacklist listings warrants defensive blocking. The China Mobile association and Beijing geographic attribution suggest legitimate mobile infrastructure, but the blacklist presence indicates compromise or abuse activity. No open services detected suggests either proper firewall configuration or non-service endpoints.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.