36.153.28.94📋 Copy

# IP Intelligence Briefing: 36.153.28.94

## Executive Summary

IP address 36.153.28.94 is classified as High Risk with a risk score of 80/100. The IP is associated with China Mobile Communications Corporation (CMNET), ASN 56046, and is located in Hohhot, Inner Mongolia, China. While the subnet shows minimal abuse density, this specific IP has been flagged on multiple DNSBL listings and requires immediate monitoring.

## Threat Profile

• Risk Score: 80/100 (High Risk)
• Country: China (CN)
• Region: Hohhot, Inner Mongolia (NM)
• ASN: 56046 (CMNET)
• Organization: haijun li / China Mobile Communications Corporation
• Registration Date: 2011-01-24 (APNIC)
• Network Role: Firewalled / No Services Detected
• Operator Score: 0.1304 (Minimal)

## Network Classification

• Provider Score: 0
• Authority Score: 0
• Stability Label: Not Available
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0 (traditional lists)
• DNSBL Listed: 6 of 8 total lists
• Route Stability: Unstable (isRouteStable: false)
• RPKI State: Not Available
• IRR Consistency: Not Available

## Historical Observation Summary

Analysis of the signal history reveals:

• 20 total observations recorded
• Recent listings show high severity classifications
• ASN 56046 consistently associated with 36.153.28.0/24 prefix
• Operator score labeled "Minimal" across multiple observations
• No persistent malicious activity detected over observation window

## Network Relationships

The IP maintains 26 relationship entries, all classified as "Same Network" relationships with CMNET. This indicates the address is part of a larger Chinese telecommunications infrastructure network with no cross-organizational associations detected.

## Subnet Neighborhood Analysis (36.153.28.0/24)

• Abuse Density: 0 (Clean classification)
• Total Siblings: 1
• Active Siblings: 1
• Threat Siblings: 0
• Risk Distribution: No high/medium/low risk neighbors detected
• Classification: Clean subnet with minimal inherited risk

## Recommended Security Actions

Immediate Actions Required

1. Increase logging verbosity and review recent activity from this IP

2. Block at perimeter - Recommended firewall rules:

```bash

# iptables

iptables -A INPUT -s 36.153.28.94 -j DROP

# nftables

nft add rule inet filter input ip saddr 36.153.28.94 drop

# nginx

deny 36.153.28.94;

# pfSense

36.153.28.94/32

# Cloudflare WAF

{"description":"Block 36.153.28.94 — IPDebrief risk score 80","action":"block","filter":{"expression":"ip.src eq 36.153.28.94"}}

# AWS WAF

{"Addresses":["36.153.28.94/32"],"Description":"IPDebrief risk 80"}

```

## Intelligence Assessment

Despite the subnet's clean classification, IP 36.153.28.94 presents an elevated risk profile due to:

• High risk score (80/100)
• Multiple DNSBL listings (6 of 8 total)
• Recent high-severity activity patterns
• Unstable routing configuration

The lack of open services and firewalled status suggests the IP may be used for scanning, reconnaissance, or as a temporary endpoint for malicious activity. However, the clean subnet environment and absence of known campaign correlations reduce the likelihood of coordinated attack activity.

Recommendation: Implement blocking rules immediately while maintaining enhanced logging for forensic analysis. Monitor for any changes in IP behavior or subnet-wide activity patterns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.