221.11.51.25
## Threat Intelligence Briefing: 221.11.51.25/32
Executive Summary
The IP address 221.11.51.25 was profiled on 2026-07-29. The address registered a risk score of 25 (Low Risk) with a reputation classification of Low Risk. The address is associated with China Unicom mobile network infrastructure and operates within the APNIC RIR allocation under the PPPoe network block.
Network Ownership and Geolocation
The address is assigned to ASN 4837 (CNCGroup-SN Hostmaster) within the PPPoe CIDR block (221.11.51.0/24). Geolocation data indicates the address originates from Shaanxi Province, China (CN), with a 2500km accuracy radius. The connection technology identified as LTE/5G mobile traffic via China Unicom (MCC 460, MNC 01).
Network Role and Services
No active services were detected on the address. The service purpose was classified as "Firewalled / No Services" with no open ports identified during scanning. No TLS certificates, HTTP titles, or server banners were observed. The address does not resolve to any PTR hostnames and has zero forward resolution records.
Threat Indicators and Blacklist Status
Threat assessment found no active attack indicators. The address is not identified as a Tor exit node, known attacker, or spam source. No known security campaigns were correlated with this address. The address appeared on 1 of 8 DNSBL lists with maximum severity rated as "high" during one observation. No email authentication records (SPF, DMARC) were detected.
Neighborhood Assessment
The /24 subnet (221.11.51.0/24) showed no neighboring IP activity. Risk distribution across the subnet was neutral with zero high, medium, or low risk neighbors. Abuse density for the subnet was 0. No threat siblings were identified in the neighborhood analysis.
Historical Observations
Thirteen total observations were recorded between 2026-07-29. Confidence levels ranged from 0.30 to 0.90. Network role classifications remained consistent across observations with no changes to CDN, VPN, proxy, or hosting classifications. Ownership stability remained constant with zero ownership changes detected.
Relationship Graph
The relationship graph identified three connections to the same network (PPPoe). No additional relationships to hostnames, organizations, or certificates were discovered.
Recommended Actions
No specific security actions were generated based on the risk profile. The low-risk classification and absence of active service exposure suggest limited immediate threat to defensive operations.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | CNCGroup-SN Hostmaster |
| ASN | AS4837 |
| Network Name | PPPoe |
| CIDR Block | 221.11.51.0/24 |
| RIR | APNIC |
| Country | CN |
| Abuse Contact | — |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Mobile |
| Service Purpose | Firewalled / No Services |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 0% | 0 | 0 |
| routing | 0% | 0 | 0 |
| services | 0% | 0 | 0 |
| ownership | 25% | 1 | 1 |
| reputation | 0% | 0 | 0 |
| geolocation | 35% | 2 | 2 |
| Overall | 10% | 3 | 3 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-21 06:47:19 UTC |
| Last Seen | 2026-07-29 07:25:59 UTC |
| Profile Built | 2026-07-29 07:32:45 UTC |
| Data Freshness | Live |
| Signal Types | 14 |
| Total Observations | 14 |
Full dossier details are available via our API.