RDAPNetwork CHINANET-GD (1.10.16.0 - 1.10.31.255), CN; IRT-CHINANET-CN, IPMASTER CHINANET-GD, Chinanet Hostmaster.
- Org
- IRT-CHINANET-CN, IPMASTER CHINANET-GD, Chinanet Hostmaster
- Range
- 1.10.16.0 - 1.10.31.255
- Country
- CN
- Network
- CHINANET-GD
Verdict
MALICIOUSMedium confidence
1Supporting signals
1Independent sources
0Recent observations
80 / 100Threat score
Why the engine decided this
Deterministic engine · activity high- SPAMHAUS_DROP The address lies in a network Spamhaus lists as hijacked or run by criminals (DROP).
- RECENT_MALICIOUS_ACTIVITY Strongest malicious evidence is 30 days old or less.
Key indicators
- IP range
- 1.10.16.0/24
- Network
- CHINANET-GD
- Country
- China (CN)
- Addresses
- 256
- Spamhaus DROP
- Listed (DROP)
- Listed IPs inside
- None today
- First seen
- Not reported by any source
- Last seen
- —
Relationship graph
ExpandNo related infrastructure in the evidence.
| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
 Spamhaus DROP | Inside 1.10.16.0/20, a block Spamhaus DROP lists as hijacked or run by criminals (SBL256894). | — | — | Strong |
| RDAP | Network CHINANET-GD (1.10.16.0 - 1.10.31.255), CN; IRT-CHINANET-CN, IPMASTER CHINANET-GD, Chinanet Hostmaster. | — | — | Context |
Coverage · checked, no record: RIPEstat, Listed IPs inside · failed: none
Analyst summary
Consistent with engineMalicious, medium confidence. Inside 1.10.16.0/20, a block Spamhaus DROP lists as hijacked or run by criminals (SBL256894). It rests on one source family, so confidence is medium.
Why the evidence points to malicious
- [Spamhaus DROP] Inside 1.10.16.0/20, a block Spamhaus DROP lists as hijacked or run by criminals (SBL256894).
Only one source family reports malicious activity.
Attribution
The evidence does not establish who operates this indicator.
Written by rules from the engine's evidenceSuggested pivots
Threat context
Context onlyNo group is directly linked to this indicator by any source.
All evidence
4 sources queried · click a row for its raw fields · ages computed by the engine| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| Spamhaus DROP | Inside 1.10.16.0/20, a block Spamhaus DROP lists as hijacked or run by criminals (SBL256894). | — | — | Strong |
| RDAP | Network CHINANET-GD (1.10.16.0 - 1.10.31.255), CN; IRT-CHINANET-CN, IPMASTER CHINANET-GD, Chinanet Hostmaster. | — | — | Context |
 RIPEstat | No record. | — | — | No record |
| Listed IPs inside | No record. | — | — | No record |
Engine rules applied
- SPAMHAUS_DROPThe address lies in a network Spamhaus lists as hijacked or run by criminals (DROP).
- RECENT_MALICIOUS_ACTIVITYStrongest malicious evidence is 30 days old or less.
- SINGLE_SOURCE_ONLYOnly one source family provides malicious evidence.
Analyst summary
Consistent with engineMalicious, medium confidence. Inside 1.10.16.0/20, a block Spamhaus DROP lists as hijacked or run by criminals (SBL256894). It rests on one source family, so confidence is medium.
Why the evidence points to malicious
- [Spamhaus DROP] Inside 1.10.16.0/20, a block Spamhaus DROP lists as hijacked or run by criminals (SBL256894).
Only one source family reports malicious activity.
Attribution
The evidence does not establish who operates this indicator.
Written by rules from the engine's evidenceSuggested pivots
Key indicators
- IP range
- 1.10.16.0/24
- Network
- CHINANET-GD
- Country
- China (CN)
- Addresses
- 256
- Spamhaus DROP
- Listed (DROP)
- Listed IPs inside
- None today
- First seen
- Not reported by any source
- Last seen
- —
By source
RDAPRelationship graph
Click a node for details · edges are observed relationships, not ownershipNo related infrastructure in the evidence.
Context
Attribution
The evidence does not establish who operates this indicator.
Relationship ≠ ownership. Shared IPs, ASNs or platforms never imply the same operator.
Threat context
Context onlyNo group is directly linked to this indicator by any source.
Evidence timeline
- 2026-10-02Investigated
No source gave a date for its record; recency could not be established.
Recommended next steps
- blockBlock or alert on traffic to and from 1.10.16.0/24 at the edge.
- huntSearch firewall and proxy logs for connections to 1.10.16.0/24 in the last 30 days.
Pivot to other tools
Opens the indicator in the source's own site (new tab).