223.109.141.101📋 Copy

# IP Intelligence Briefing: 223.109.141.101/32

Classification: Low Risk – Mobile Carrier Infrastructure

Date: 2026-06-23

Risk Score: 25/100

## Executive Summary

IP 223.109.141.101 is a Chinese mobile carrier address (China Mobile/CMNET) classified as low-risk infrastructure. The IP shows no active malicious indicators, is not associated with known campaigns, and maintains a stable operational profile consistent with mobile carrier services.

## Ownership & Geolocation

## Network Role & Services

• Classification: Mobile Carrier
• Status: Firewalled / No Services
• Open Ports: None detected
• DNS Resolution: No PTR records, no forward resolution
• Email Authentication: No SPF/DMARC records

## Threat Assessment

• Risk Score: 25 (Low Risk)
• Known Campaigns: None
• Known Attacker: False
• Tor Exit Node: False
• Spam Source: False
• Blacklist Count: 0
• DNSBL Listed: 1 (minor listing)
• Abuse Confidence Score: Not applicable

## Subnet Neighborhood Analysis

Subnet: 223.109.141.0/24

• Abuse Density: 0 (Low)
• Classification: Mostly clean
• Total Siblings: 2
• Active Siblings: 1
• Risk Distribution: High: 0, Medium: 1, Low: 1

Notable Neighbors:

• 223.109.141.9 – Risk Score: 50 (Medium)
• 223.109.141.190 – Risk Score: 0 (Low)

## Historical Observations

22 observations recorded between 2026-06-18 and 2026-06-23:

• Geolocation: Consistent Beijing region assignment
• Routing: Minimal operator score (0.2174)
• Threat Persistence: No persistent malicious behavior
• Threat Observation Count: 1 (historical)
• Is Persistently Malicious: False

## Control Plane Data

• BGP Prefix: 223.109.140.0/22
• Route Stability: False
• DNSSEC: Valid
• CAA Records: Present
• RPKI State: Not available
• IRR Consistency: Not available

## Recommended Actions

No specific firewall rules or mitigation actions required at this time. The IP profile indicates legitimate mobile carrier infrastructure with no active threat indicators.

Monitoring Recommendation: Standard monitoring for mobile carrier traffic. No blocking or rate-limiting recommended unless specific suspicious activity is observed.

---

*Intel generated by IPDebrief – Authorized Defensive Security Analysis*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.