223.104.128.111📋 Copy

# IP Intelligence Briefing: 223.104.128.111

## Executive Summary

IP address 223.104.128.111 is a legitimate China Mobile mobile carrier endpoint classified as Low Risk with a risk score of 25. The IP belongs to the CMNET network (ASN 9808) under IRT-CHINAMOBILE-CN and is part of the 223.64.0.0/11 block registered with APNIC. No malicious activity, blacklisting, or threat indicators were observed.

## Profile Characteristics

Ownership & Classification:

• Organization: IRT-CHINAMOBILE-CN (China Mobile Communications Corp.)
• Network: CMNET (223.64.0.0/11)
• ASN: 9808 (China Mobile)
• RIR: APNIC
• Geographic Location: Beijing, China (CN)
• Infrastructure Type: Mobile Carrier (LTE/5G)
• Connection Technology: China Mobile (MCC: 460, MNC: 00)

Risk Assessment:

• Overall Risk Score: 25 (Low Risk)
• Abuse Confidence Score: Not applicable (mobile carrier IP)
• Is Known Attacker: False
• Is Spam Source: False
• Is Tor Exit Node: False
• Blacklist Count: 0
• Control Plane Operator Score: 0.1304 (Minimal)

Network Services:

• Open Ports: None detected
• DNS PTR Hostnames: None
• Forward Resolution: Not confirmed
• TLS Certificates: None
• HTTP Services: None (Firewalled / No Services)
• Email Authentication: No SPF/DMARC records (mobile carrier endpoint)

## Observation History

Fourteen signal observations recorded through July 23, 2026. Key temporal indicators show:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 0
• Persistently Malicious: False
• Recent signals confirm mobile carrier classification, APNIC registration, and Chinese geolocation with high confidence (0.90-0.95)

## Neighborhood Analysis

The /24 subnet (223.104.128.0/24) contains 7 sibling IPs with an abuse density of 0. Risk distribution shows 7 low-risk neighbors and 0 high-risk or medium-risk IPs. Neighbor risk scores range from 0-25, consistent with legitimate mobile carrier traffic patterns. No correlated threat siblings detected.

## Relationships

Two relationship records identified, both linking to the CMNET network classification. No hostnames, organizations, or certificates beyond the primary network association.

## Threat Indicators

• No threat indicators flagged
• No known campaigns associated
• No pulsedive risk data
• No DNSBL correlation (despite 1 DNSBL listing in control plane data, overall blacklist count remains 0)

## Recommended Actions

No security actions required. This IP represents normal mobile carrier traffic infrastructure. The absence of open services, threat indicators, and blacklisting confirms operational legitimacy. Standard mobile carrier traffic handling procedures apply.

---

*Analysis prepared from IPDebrief intelligence data. Classification: Defensive Security Intelligence*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.