27.128.160.208📋 Copy

# IP Intelligence Briefing: 27.128.160.208/32

Classification: Moderate Risk (Score: 65/100)

Date: 2026-06-23

Report Type: Threat Intelligence Assessment

---

## Executive Summary

IP address 27.128.160.208 presents a moderate risk threat profile originating from China Telecom's mobile network infrastructure. The IP is registered to CHINANET-HE (ASN 4134) and demonstrates historical DNSBL listing activity. Network classification indicates firewalled status with no active services, though connection type is identified as mobile (China Telecom LTE/5G). SOC teams should implement monitoring controls and consider blocking based on risk score.

---

## Network Ownership & Infrastructure

---

## Threat Indicators

• Risk Score: 65/100 (Moderate)
• Abuse Confidence: Elevated based on historical patterns
• Blacklist Status: Listed on 2 of 8 DNSBL feeds (historical data)
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Campaign Affiliation: None detected

Historical Abuse Pattern: Signal history reveals DNSBL listings with high severity ratings across multiple observation periods (June 18, 2026 and June 23, 2026). Three to eight blacklist listings observed per probe with maximum severity marked as "high."

---

## Neighborhood Analysis

Subnet: 27.128.160.208/24

• Abuse Density: 0
• Risk Distribution: No high/medium/low risk siblings detected
• Active Siblings: 1
• Threat Siblings: 1

The immediate /24 subnet shows minimal abuse activity, though the IP maintains a moderate risk score independent of neighborhood classification.

---

## Relationships

Primary Association: CHINANET-HE (43 relationship entries)

All detected relationships indicate membership within the China Telecom network infrastructure. No external hostnames, certificates, or organizational links identified.

---

## Observation History Summary

• Total Observations: 24
• Most Recent Signal: 2026-06-23T09:34:02
• Signal Consistency: DNSBL listings with high severity observed across multiple timestamps
• Geo Validation: Distance 8,033.2km from probe origin (consistent with China location); ICMP validation blocked
• Threat Persistence: No persistent malicious behavior detected

---

## Recommended Actions

Primary Action: Increase logging verbosity and review recent activity from this IP (Severity: High)

Firewall Rules Implemented:

• iptables: `iptables -A INPUT -s 27.128.160.208 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 27.128.160.208 drop`
• nginx: `deny 27.128.160.208;`
• pfSense: `27.128.160.208/32`
• Cloudflare WAF: Block with expression `ip.src eq 27.128.160.208`
• AWS WAF: Address `27.128.160.208/32`

---

## Conclusion

IP 27.128.160.208 is a mobile network address from China Telecom's LTE/5G infrastructure under CHINANET-HE ownership. The moderate risk score (65/100) combined with historical DNSBL listings warrants defensive blocking. No active services or open ports detected; connection shows as firewalled. SOC teams should implement the recommended firewall rules and monitor for any activity changes.

Recommendation: Block IP address at perimeter firewall. Maintain logs for forensic review.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.