103.69.193.110
IP Intelligence Dossier
Your IP: 216.73.216.123
🤖 Witness AIThis summary was generated by AI and may contain inaccuracies. Verify critical details independently.
IP Intelligence Briefing: 103.69.193.110
Date: 2026-06-17
---
**1. Core Profile**
- Risk Score: 80 (High Risk)
- Ownership: Registered to Nguyen Nam Lua (AS45899, SOHA-VN).
- Geolocation: Vietnam (VN), no city/region specified.
- Network Role: Web server (HTTP/HTTPS, SSH), Apache 2.4.6, PHP 7.1.19.
- Threat Indicators: No direct malicious indicators (no malware, phishing, or known attacker tags).
---
**2. Observation History**
- Recent Activity:
- June 17, 2026: Detected in 8 threat feeds (3 high-severity listings).
- June 14, 2026: 503 HTTP errors observed; server banner matches known Apache/PHP stack.
- June 13, 2026: 4 DNSBL listings (likely spam or abuse-related).
- Trend: No persistent malicious activity; risk score remains stable.
---
**3. Network Relationships**
- Subnet: 103.69.193.110/24 (SOHA-VN).
- Neighbors: No active neighboring IPs reported (subnet abuse density: 0%).
- DNS: Valid DNSSEC, SPF/DKIM records present.
- Certificates: Valid SSL/TLS certificate (GlobalSign CA) for bluebit.vn.
---
**4. Security Actions**
- Recommended Mitigations:
- Monitor for DNSBL-related abuse (4 listings).
- Block IP in firewall rules (iptables/nftables) due to high risk score.
- Investigate 503 errors and HTTP server configuration.
---
**5. Analysis**
- Likely Use Case: Legitimate web server in Vietnam, possibly hosting bluebit.vn.
- Risk Factors: High risk score, DNSBL listings, and ambiguous geolocation.
- Next Steps: Correlate with internal logs, verify DNSBL context, and monitor for unexpected traffic patterns.
SOC Action Required: Block IP in perimeter defenses and validate DNSBL status with upstream providers.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Nguyen Nam Lua |
| ASN | AS45899 |
| Network Name | SOHA-VN |
| CIDR Block | 103.69.192.0/22 |
| RIR | APNIC |
| Country | VN |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 60% (Good) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| 22 | ssh | tcp | |
| Closed Ports | 25, 3389, 8080, 8443 (3 open / 7 scanned) | ||
| Server | Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.19 |
| HTTP Title | — |
| SSH Version | SSH-2.0-OpenSSH_7.4 |
🔐 TLS Certificate
CN=www.bluebit.vn, O=GLOBALSIGN VIETNAM JOINT STOCK COMPANY, L=Ha Noi, S=Ha Noi, C=VN
Issued by CN=GlobalSign RSA OV SSL CA 2018, O=GlobalSign nv-sa, C=BE
Self-signed: No
| SANs | www.bluebit.vnapi.bluebit.vnbackend.bluebit.vnbluebit.vn |
| Valid From | 2025-07-07T03:51:01+00:00 |
| Valid Until | 2026-08-08T03:51:00+00:00 |
| TLS Protocol | Tls12 |
| Cipher Suite | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 |
| Signature Algorithm | sha256RSA |
| Validity Period | 396 days |
| Serial Number | 4AC00B451B943940225BA806 |
| Thumbprint | CDC81A32FEBCDB957C7EB62C1C4CDE71BFFBBFB5 |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 35% | 2 | 4 |
| routing | 13% | 1 | 1 |
| services | 26% | 2 | 3 |
| ownership | 27% | 2 | 3 |
| reputation | 15% | 1 | 2 |
| geolocation | 21% | 2 | 2 |
| Overall | 23% | 10 | 15 |
Coverage: 6/6 dimensions · Data sufficiency: sufficient
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-07 23:03:27 UTC |
| Last Seen | 2026-06-22 07:24:44 UTC |
| Profile Built | 2026-06-22 07:31:24 UTC |
| Data Freshness | Live |
| Signal Types | 20 |
| Total Observations | 22 |
🔍 20 signal types · 22 observations collected
This report is generated from 20+ independent intelligence signals including
ownership records, DNS analysis, BGP routing, TLS certificates, port scanning, threat feeds,
behavioral fingerprinting, and more.
Full dossier details are available via our API.
Full dossier details are available via our API.
ℹ️ About This Report
All data shown is publicly available network metadata — IP addresses do not reliably identify individuals.
Assessments are probabilistic and should not be used as sole basis for access control decisions.
To report an issue or request data review, contact admin@ipdebrief.com.