36.106.78.209📋 Copy

# IP Intelligence Briefing: 36.106.78.209/32

## Executive Summary

IP 36.106.78.209 is assessed as LOW RISK with an overall risk score of 25. The address belongs to CHINANET-TJ (China Telecom Tianjin), a Tier-1 ISP network. No active malicious indicators, open services, or known threat associations detected. Recommended action: Monitor without blocking.

---

## Technical Profile

Ownership & Registration

• ASN: 17638 (Chinanet Hostmaster)
• Network: CHINANET-TJ (36.106.0.0/16)
• Organization: China Telecom Tianjin
• RIR: APNIC
• Abuse Contact: anti-spam@chinatelecom.cn

Geolocation

• Country: China (CN)
• Region/City: Tianjin
• Coordinates: 39.14°N, 117.17°E
• Timezone: Asia/Shanghai

Network Classification

• Infrastructure Type: Firewalled / No Services
• Open Ports: None detected
• DNS Resolution: No PTR hostnames; no forward resolution
• TLS/HTTP: No certificates or HTTP banners observed

---

## Threat Indicators

Risk Assessment

• Overall Risk Score: 25 (Low Risk)
• Abuse Confidence Score: Not applicable
• DNSBL Listings: 1 of 8 lists (minimal impact)
• Blacklist Count: 0

Threat Status

• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Known Campaigns: None identified
• Persistent Threat Activity: False

Behavioral Signals

• Honeypot Hits: 0
• Enumeration Strikes: 0
• WAF Violations: 0
• Total Incidents: 0

---

## Observation History (11 Records)

Temporal Analysis

• Latest Observation: 2026-07-22T14:09:26 UTC
• Geolocation Consistency: Stable (Tianjin, China)
• Ownership Changes: 0 (stable)
• Threat Observation Count: 0

Historical Signals

• Geolocation data consistently from MaxMind GeoLite2
• Operator score maintained at 0.1304 (Minimal)
• No threat persistence or escalation patterns detected

---

## Relationship Graph

Connected Entities

• Network: CHINANET-TJ (36.106.76.0/22)
• Hostnames: None associated
• Organizations: None beyond ISP registration
• Certificates: None

External Correlations:

• Subnet Abuse Density: 0
• Related Threat IPs: 0
• Campaign Correlations: 0

---

## Neighborhood Analysis (36.106.78.0/24)

Subnet Assessment

• Total Neighbors: 0
• High-Risk Neighbors: 0
• Medium-Risk Neighbors: 0
• Low-Risk Neighbors: 0
• Abuse Density: 0

Conclusion: No neighboring IPs with threat activity detected in the /24 block.

---

## Control Plane Analysis

BGP & Routing

• Origin ASN: 17638
• BGP Prefix: 36.106.76.0/22
• Route Stability: False (route changes noted)
• RPKI State: Not available
• IRR Consistency: Not available

DNS Security

• DNSSEC Valid: True
• CAA Records: None
• DNSBL Listed: 1 list

---

## Recommended Actions

Security Posture: MONITOR

Firewall Rule Recommendations

• Default: Permit with logging
• No specific deny rules warranted

---

## SOC Analyst Notes

This IP represents standard Chinese telecom infrastructure with no malicious indicators. The single DNSBL listing is minor and may relate to historical or false-positive classification. Route instability is noted but does not indicate active threat behavior. No services are running from this address, suggesting it may be a residential or enterprise endpoint rather than a server.

Final Risk Assessment: LOW RISK

Recommended Handling: Monitor; no immediate action required

Last Updated: 2026-07-22

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.