220.165.85.39📋 Copy

## IP INTELLIGENCE BRIEFING: 220.165.85.39/32

Executive Summary

IP address 220.165.85.39 presents a HIGH RISK profile (80/100) originating from China's Chinanet infrastructure. The address is associated with mobile carrier China Telecom and classified as a residential/mobile endpoint. While the broader subnet shows low abuse density, this specific IP exhibits elevated threat indicators including DNSBL listings and historical blacklist activity requiring defensive attention.

---

Technical Profile

---

Threat Indicators

• DNSBL Listings: 6/8 total lists flagged
• Historical Blacklists: 8 total lists with 5 high-severity listings as of June 23, 2026
• Operator Score: 0.1304 (Minimal)
• Campaign Correlation: No known threat campaigns
• Threat Persistence: No persistent malicious activity detected

---

Network Context

• Subnet: 220.165.85.39/24
• Abuse Density: 1 (Low)
• Subnet Classification: Mostly Clean
• Active Siblings: 1
• Threat Siblings: 1
• Total Siblings: 1
• Relationships: 66 relationships, all mapping to CHINANET-YN infrastructure

---

DNS & Service Analysis

• PTR Record: 39.85.165.220.broad.yx.yn.dynamic.163data.com.cn
• Forward Resolution: Not confirmed
• Hosted Domains: None (0)
• Open Ports: None detected
• TLS Certificates: None
• HTTP Services: None detected

---

Historical Activity

Signal observation history indicates 21 total observations. Recent activity from June 18-23, 2026 shows:

• Multiple blacklist listings with high severity ratings
• Geo-location inference pointing to China (CN)
• Operator scoring remained at minimal levels
• No consistent threat pattern established

---

Recommended Actions

Based on risk profile analysis, the following defensive measures are recommended:

Immediate Actions:

1. Block at perimeter firewall (recommended for iptables, nftables, pfSense, Cloudflare WAF, AWS WAF)

2. Increase logging verbosity for any traffic from this IP

3. Review recent activity from this address for potential compromise indicators

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 220.165.85.39 -j DROP

# nftables

nft add rule inet filter input ip saddr 220.165.85.39 drop

# nginx

deny 220.165.85.39;

```

---

Intelligence Assessment

This IP address represents a high-risk mobile endpoint from Chinese infrastructure with historical blacklist activity. The combination of elevated risk score (80), multiple DNSBL listings, and mobile carrier attribution suggests potential abuse activity. While the broader subnet maintains low abuse density, this specific address warrants blocking at the network perimeter and enhanced monitoring on any systems that may have interacted with this IP.

Classification: High Risk - Block and Monitor

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.