202.194.98.214📋 Copy

# IP INTELLIGENCE BRIEFING: 202.194.98.214/32

## Executive Summary

Risk Level: LOW (Score: 25/100)

Classification: Legitimate Academic/Research Infrastructure

Recommendation: Monitor, no immediate blocking required

## Network Profile

• ASN: 4538 (IRT-CERNET-AP)
• Organization: IRT-CERNET-AP (China Education and Research Network)
• Network Range: 202.192.0.0/13
• Geolocation: Beijing, China (100084)
• Timezone: Asia/Shanghai
• Registration: APNIC RIR

## Current Status

• Service Status: Firewalled / No Services Detected
• Open Ports: None
• DNS Resolution: No PTR records, no forward resolution
• TLS/HTTP Services: None detected
• Network Role: Residential/Infrastructure endpoint

## Threat Indicators

• Malicious Activity: None observed
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Status: 0/8 DNSBL listings
• Threat Persistence: 0 days observed

## Historical Observation Summary

• Total Signals: 14 observations
• Ownership Stability: No ownership changes detected
• Threat Persistence: 0 persistent threat observations
• Recent Activity: Signals consistently indicate China-based academic infrastructure
• Geolocation Confidence: Moderate (52% confidence on recent signals)

## Neighborhood Analysis

• Subnet: 202.194.98.0/24
• Total Siblings: 6 neighboring IPs
• Abuse Density: 0%
• Risk Distribution: 6 low-risk neighbors (scores: 25, 25, 25, 0, 25, 0)
• High/Medium Risk Neighbors: None
• Network Classification: Uniform low-risk profile

## Relationship Graph

• Same Network: CERNET-CN
• Related Entities: 1 confirmed network relationship

## Control Plane Data

• Route Stability: Unstable (isRouteStable: false)
• BGP Prefix: 202.194.0.0/15
• RPKI State: Not verified
• DNSSEC: Valid
• DNSBL Listings: 1 out of 8 total lists

## Recommended Actions

Security Posture: Accept for monitoring

• No firewall rules required at this time
• No blocking recommendations based on current risk profile
• Consider monitoring due to DNSBL listing presence (1/8 lists)

## Intelligence Narrative

IP 202.194.98.214 operates as a low-risk endpoint within the China Education and Research Network (CERNET). The IP is assigned to IRT-CERNET-AP and serves within the 202.192.0.0/13 infrastructure block. No active services are detected (firewalled configuration), and no threat indicators have been observed across the monitoring period. The IP maintains a stable relationship with the CERNET-CN network infrastructure.

The neighborhood analysis reveals a uniform low-risk profile across the /24 subnet with zero abuse density. Historical signals indicate consistent assignment to China-based academic infrastructure. One DNSBL listing exists among eight tested lists, warranting continued monitoring but not immediate action.

Assessment: This IP represents legitimate academic research infrastructure with no evidence of malicious activity. SOC teams may monitor for any changes in service status or threat indicator emergence, but no defensive blocking is warranted at this time.

---

*Intel prepared by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.