59.110.9.189📋 Copy

# IP Intelligence Briefing: 59.110.9.189/32

Classification: Moderate Risk

Date: Current Intelligence

---

## Executive Summary

IP 59.110.9.189 is associated with ALISOFT network (ASN 37963) in Beijing, China. The IP exhibits moderate risk characteristics with a risk score of 50. No active malicious services detected; the address is firewalled with no open ports. Listed on 2 of 8 DNSBLs. Historical data shows consistent operator scoring with no significant risk escalation.

---

## Network Ownership & Geolocation

---

## Risk Assessment

• Overall Risk Score: 50 (Moderate Risk)
• Abuse Confidence: Not specified
• Threat Indicators: None detected
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Blacklist Count: 0 (but listed on 2 DNSBLs)

---

## Network Behavior & Services

• Services: No open ports detected (Firewalled/No Services)
• DNS Resolution: No PTR hostnames; forward resolution failed
• Hosted Domains: None
• Email Reputation: Not applicable (no domains)
• SSL/TLS: No certificates detected
• Network Classification: Not cloud, CDN, VPN, proxy, Tor, or hosting

---

## Control Plane Analysis

• AS Path: 34549 → 4134 → 23724 → 37963
• IRR Consistency: Conflict detected
• DNSSEC: Valid
• Route Stability: Stable
• MOAS: No
• Operator Score: 0.3478 (Basic)

---

## Neighborhood Analysis (59.110.9.0/24)

• Subnet Abuse Density: 1
• Classification: Mostly Clean
• Total Siblings: 1
• Active Siblings: 1
• Threat Siblings: 1
• Inherited Risk: 2

---

## Historical Observation

• Total Observations: 38
• Latest Observation: 2026-06-19 19:11:51 UTC
• Consistency: Operator score maintained at 0.3478 across all observations
• Risk Trend: Stable; no escalation detected
• Threat Persistence: Not persistently malicious

---

## Recommended Security Actions

Firewall Rules

---

## Intelligence Notes

1. No Active Threats: Despite moderate risk score, no active malicious services or ports detected.

2. DNSBL Presence: Listed on 2 of 8 DNSBLs; investigate for false positives or historical abuse.

3. IRR Conflict: IRR inconsistency detected; recommend validation with network operations.

4. Regional Context: Chinese origin with Beijing geolocation; verify against known threat actor infrastructure.

5. Block Recommendation: Default block advised due to DNSBL listings and moderate risk profile, but confirm with additional threat intelligence sources before enforcement.

---

Analysis Methodology: IPDebrief full profile, historical observation analysis, relationship mapping, neighborhood assessment, and actionable firewall rule generation.

Recommendation: Monitor or block based on organizational policy for moderate-risk foreign IPs with DNSBL listings.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.