103.161.170.12📋 Copy

# IP Intelligence Briefing: 103.161.170.12/32

Classification: Moderate Risk

Report Date: Based on available intelligence through June 2026

## Executive Summary

IP address 103.161.170.12 is a Vietnamese web server infrastructure endpoint operated by IRT-VNNIC-AP (ASN 135918). The asset carries a risk score of 65 (Moderate Risk), with evidence of DNSBL listing presence. While the IP itself shows no direct threat indicators, neighborhood analysis indicates related malicious activity within the /24 subnet.

## Ownership and Infrastructure

• Organization: IRT-VNNIC-AP (IRT Vietnam Network Information Center)
• Network Name: VINABISON-VN
• ASN: 135918
• CIDR Block: 103.161.170.0/23
• RIR: APNIC
• Geolocation: Hanoi, Vietnam (GeoPlausible: true)
• BGP Prefix: 103.161.170.0/23
• Route Stability: Stable (routeChanges30d: 0)
• RPKI State: Mismatch detected

## Network Services

• Open Ports: 80/tcp (HTTP), 443/tcp (HTTPS)
• Web Server: nginx/1.20.1
• TLS Certificate: Issued by Let's Encrypt (CN=E8, O=Let's Encrypt, C=US)
• Certificate Subject: CN=pa-2.ducnv25.id.vn
• Covered Domains: *.pa-2.ducnv25.id.vn, pa-2.ducnv25.id.vn

## Threat Indicators

• Blacklist Count: 3 of 8 DNSBL lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Correlation: None identified
• Known Campaigns: None
• Threat Feeds: Empty

## Control Plane Intelligence

• Operator Score: 0.3478 (Basic operator)
• IRR Consistency: Mismatch
• DNSSEC Valid: True
• CAA Records: Present
• Route Origin: ASN 135918 (103.161.170.0/23)

## Neighborhood Analysis (103.161.170.0/24)

• Subnet Classification: Mostly clean
• Abuse Density: 1 (Low to moderate)
• Total Siblings: 1 active
• Threat Siblings: 1 detected
• Inherited Risk: 2 (Low)
• Risk Distribution: High: 0, Medium: 0, Low: 0 (per current scan)

## Historical Observations

Analysis of 30 historical observations reveals:

• Route Stability: Consistent operator scores ranging 0.17–0.35
• Geolocation Signals: Consistent Vietnam (VN) attribution with multi-signal inference
• Service Observations: HTTP/HTTPS services persistently observed
• Threat Persistence: 0 days (not persistently malicious)
• Ownership Changes: 0 detected
• Latest Signal: 2026-06-22 (route/geolocation confidence: 0.60)

## Intelligence Assessment

The target IP operates as a legitimate web infrastructure endpoint with standard web server functionality. While the IP itself shows no direct malicious activity, three DNSBL listings and a detected threat sibling within the /24 subnet warrant monitoring. The IRR mismatch and DNSBL presence suggest potential configuration or reputation issues at the network level.

## Recommended Actions

Based on current risk profile:

1. Monitor: Track DNSBL listing status and subnet activity

2. Allow: HTTP/HTTPS traffic from this IP is likely legitimate

3. Block: No immediate block required, but consider monitoring for abuse pattern correlation

4. Verify: Confirm service legitimacy if receiving traffic from this endpoint

---

*Intelligence compiled from IPDebrief platform data. For complete profile access, consult the full IPDebrief report.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.