218.4.91.163📋 Copy

# Threat Intelligence Briefing: 218.4.91.163/32

## Executive Summary

IP 218.4.91.163 is a Chinese mobile-registered address assigned to pan zhen (SUZHOU-CS-TRADE-ADMIN) with an elevated risk score of 65/100. The address shows no open services and is classified as firewalled/no services. While not listed on known threat feeds, the IP has been observed on 3 of 8 DNSBL lists with high severity in recent monitoring.

## Risk Assessment

• Risk Score: 65/100 (Moderate Risk)
• Classification: Mobile device connection (China Telecom LTE/5G)
• Geolocation: China (CN), Jiangsu Province, Suzhou City
• ASN: 4134 (China Telecom)
• Block: 218.4.91.160/29

## Threat Indicators

• Blacklist Status: Listed on 3 DNSBL entries (out of 8 total)
• Campaign Association: No known campaigns correlated
• Attacker Status: Not flagged as known attacker or spam source
• Tor/Proxy: Not a Tor exit node or proxy
• Recent Activity: 14 observations recorded, with most recent listing on 2026-06-22 showing high severity

## Network Context

• Subnet Risk: 218.4.91.163/24 exhibits 0.5 abuse density (mostly clean classification)
• Sibling IP: 218.4.91.162 (risk score: 50, authority score: 50)
• Control Plane: Origin ASN 4134, BGP prefix 218.4.0.0/16, route stability compromised
• DNSBL Presence: 3 listings across 8 lists

## Technical Observations

• Services: No open ports detected; classified as firewalled/no services
• DNS: No PTR records, no forward resolution, no email authentication (SPF/DMARC absent)
• Geolocation: Distance 8,722 km from probe origin; ICMP validation blocked
• Fingerprint: No HTTP/HTTPS services detected

## Recommended Actions

Immediate:

1. Implement blocking rules for 218.4.91.163/32 across perimeter infrastructure

2. Increase logging verbosity for traffic from this IP address

3. Review historical activity logs for any anomalous behavior

Firewall Rules:

• iptables: `iptables -A INPUT -s 218.4.91.163 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 218.4.91.163 drop`
• nginx: `deny 218.4.91.163;`
• pfSense: Add 218.4.91.163/32 to block list
• Cloudflare WAF: Block IP with expression `ip.src eq 218.4.91.163`
• AWS WAF: Add 218.4.91.163/32 to block list

## Intelligence Notes

The IP shows moderate risk elevation without clear malicious indicators. The mobile carrier classification and lack of open services suggest this may be a consumer or enterprise mobile connection. Continued monitoring of the sibling IP (218.4.91.162) is recommended given its proximity and associated risk. The subnet's "mostly clean" classification with one threat sibling warrants periodic review but does not indicate coordinated infrastructure.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.