219.129.96.2📋 Copy

# IP Intelligence Briefing: 219.129.96.2/32

## Executive Summary

IP 219.129.96.2 is classified as High Risk (80/100). The address is associated with mobile carrier infrastructure from China Telecom, operating under ASN 4134 (IPMASTER CHINANET-GD). While no active threat campaigns were identified, the IP is listed on 6 DNSBLs and exhibits route instability. Immediate defensive action is recommended.

## Threat Profile

Risk Score: 80/100 (High Risk)

Geolocation: China (CN) — 2500km accuracy radius

Network Classification: Mobile Carrier / Firewalled (No Services Detected)

Mobile Carrier: China Telecom Corp. Ltd. (MCC: 460, MNC: 03, LTE/5G Technology)

ASN: 4134 (APNIC RIR)

CIDR Block: 219.136.0.0/15 (CHINANET-GD)

Abuse Confidence: DNSBL listed on 6 of 8 total blacklist sources

## Infrastructure Analysis

• Open Ports: None detected
• Services: No web services, TLS certificates, or HTTP banners observed
• DNS Resolution: No PTR hostnames or forward resolution
• Email Authentication: No SPF, DMARC, or TXT records configured
• Route Stability: Route changes observed within 30-day window; not MOAS compliant
• Operator Score: 0.2174 (Minimal)

## Historical Observations

Analysis of 20 historical signals shows consistent geolocation data pointing to China (35.86°N, 104.20°E) with 0.52 confidence. ASN registration data for CHINANET-GD (219.136.0.0/15) was observed with 0.95 confidence on 2026-06-18. Subnet abuse density classification has remained "mostly_clean" (abuse density: 1) with inherited risk of 2. No persistent malicious threat behavior has been observed over the observation period.

## Network Neighborhood

Subnet 219.129.96.2/24 assessment:

• Total Siblings: 1
• Active Siblings: 1
• Threat Siblings: 1
• Abuse Density: 1 (elevated)
• Classification: Mostly Clean
• Inherited Risk: 2

## Identified Relationships

42 relationship links identified, primarily categorized as "Same Network" connections to CHINANET-GD infrastructure. No hostname, organization, or certificate relationships detected.

## Recommended Security Actions

Immediate Action: Block traffic from this IP address at perimeter controls.

Firewall Rules:

• iptables: `iptables -A INPUT -s 219.129.96.2 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 219.129.96.2 drop`
• nginx: `deny 219.129.96.2;`
• pfSense: `219.129.96.2/32`
• Cloudflare WAF: Block IP with expression `ip.src eq 219.129.96.2`
• AWS WAF: Add 219.129.96.2/32 to block list

Additional Monitoring: Increase logging verbosity and review recent activity from this IP due to elevated risk score (80/100).

## Assessment Notes

While the IP is associated with a legitimate mobile carrier infrastructure (China Telecom), the high DNSBL listing count, route instability, and elevated neighborhood abuse density warrant defensive blocking. The absence of open services reduces immediate exploitation risk, but the IP should be treated as potentially compromised or misconfigured. Correlate with any observed malicious traffic from this source.

---

*Report generated based on IPDebrief intelligence platform analysis.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.