223.104.83.81📋 Copy

# IP Intelligence Briefing: 223.104.83.81/32

Classification: Mobile Carrier Infrastructure | Risk Level: Low (Score: 25)

Date: Current Intelligence

Jurisdiction: People's Republic of China

## Executive Summary

The IP address 223.104.83.81 was identified as part of China Mobile's CMNET mobile carrier infrastructure, specifically operating within the 223.64.0.0/11 CIDR block. The IP demonstrated low-risk characteristics throughout observation periods, with no active threat indicators, blacklist associations, or malicious campaign correlations. The address represents legitimate mobile carrier traffic with no actionable threat intelligence requiring immediate defensive response.

## Technical Profile

Network Classification

• ASN: 56040 (IRT-CHINAMOBILE-CN)
• Organization: China Mobile Communications Corp.
• Network: CMNET (223.64.0.0/11)
• Infrastructure Type: Mobile Carrier
• Connection Type: LTE/5G Mobile Network
• CC: 460-00 (China Mobile)
• Geolocation: Shenzhen, Guangdong Province, China

Risk Assessment

• Overall Risk Score: 25/100 (Low)
• Abuse Confidence Score: None
• Blacklist Count: 0
• Pulsedive Risk: None
• Known Campaigns: None
• Threat Feeds: No associations detected

Control Plane Analysis

• BGP Prefix: 223.104.80.0/22
• Traceroute Hops: 30
• Route Stability: Route changes detected within 30-day observation window
• RPKI State: Not validated
• IRR Consistency: Not reported

## Historical Observation Analysis

The IP accumulated 13 observation signals over the monitoring period. Analysis of historical data revealed:

• Ownership Changes: 0 changes detected
• Threat Persistence Days: 0 days
• Threat Observation Count: 0
• Persistent Malicious Activity: Not observed
• Provider Classification: Consistently identified as mobile carrier infrastructure

Recent observations (July 23, 2026) confirmed stable classification as China Mobile mobile carrier infrastructure with consistent geographic resolution to Shenzhen, Guangdong Province. No degradation in service quality or emergence of threat indicators was observed during the monitoring window.

## Network Relationships

The relationship graph analysis identified two associations, both representing the same CMNET network infrastructure. No external relationships to organizations, hostnames, certificates, or related IP addresses were detected. The IP operates in isolation from known threat actor infrastructure or command-and-control networks.

## Subnet Neighborhood Analysis

Analysis of the 223.104.83.0/24 subnet revealed the following characteristics:

• Total Neighbors: 12 sibling IPs in /24
• Abuse Density: 0
• High Risk Neighbors: 0
• Medium Risk Neighbors: 0
• Low Risk Neighbors: 12

Neighbor risk distribution showed all adjacent addresses in the /24 subnet operated at low-risk scores (0-25), with authority scores ranging from 0-50. No high-risk or medium-risk neighbors were present, indicating the subnet operates as a relatively clean mobile carrier infrastructure zone.

## Services and DNS Analysis

• Open Ports: None detected
• TLS Certificates: None
• HTTP Titles: None
• PTR Hostnames: None
• Forward DNS Resolution: 0 records
• Hosted Domains: 0
• Email Authentication (SPF/DMARC): Not configured
• Service Purpose: Firewalled / No Services

## Recommended Defensive Actions

Based on the risk profile and observed behavior, no immediate firewall rules or blocking actions are recommended for IP 223.104.83.81. The IP represents legitimate mobile carrier infrastructure with:

• Low overall risk score (25/100)
• No active threat indicators
• No blacklist associations
• No historical malicious activity

Recommended Handling: Allow traffic from this IP range. If traffic is observed requiring further investigation, correlate with other signals (port scans, unusual protocol usage, geographic anomalies) before taking action.

## Intelligence Conclusion

IP 223.104.83.81 represents standard China Mobile mobile carrier infrastructure operating in Shenzhen, Guangdong Province. The address demonstrated consistent low-risk behavior throughout the observation period with no threat intelligence indicators. No defensive actions are warranted based on current data. Monitor for any changes in traffic patterns or the emergence of threat indicators that would update this assessment.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.