# IP Intelligence Briefing: 115.76.49.6/32
Classification: Moderate Risk (Score: 40)
Date: 2026-07-28
Analyst: IPDebrief Intelligence System
---
## Executive Summary
Target IP 115.76.49.6/32 is registered to VIETTEL-VN (ASN 7552) under IRT-VNNIC-AP, with geolocation attributed to Bien Hoa, Đồng Nai Province, Vietnam. The IP exhibits moderate risk characteristics with 2 DNSBL listings but no confirmed malicious activity or known attack campaigns. Current network assessment indicates firewall protection status with no open services detected.
---
## Network Ownership & Registration
| Attribute | Value |
|---|---|
| **ASN** | 7552 |
| **Organization** | IRT-VNNIC-AP |
| **Netname** | VIETTEL-VN |
| **CIDR Block** | 115.72.0.0/13 |
| **RIR** | APNIC |
| **Country** | Vietnam (VN) |
| **City/Region** | Bien Hoa, Đồng Nai Province |
---
## Threat Assessment
- Risk Score: 40 (Moderate)
- Threat Indicators: None detected
- Known Campaigns: None
- Blacklist Count: 2 DNSBL listings
- Abuse Confidence Score: Not available
- Tor Exit Node: No
- Known Attacker: No
- Spam Source: No
---
## Network Classification
- Infrastructure Type: Firewall protected / No services
- Connection Type: Not classified
- Cloud/CDN/VPN/Proxy: No
- Mobile/Residential: Not classified
- Bogon: No
- Anycast: No
---
## DNS & Network Behavior
- PTR Hostname: adsl.viettel.vn
- Forward Resolution: Failed
- Email Authentication: SPF and DMARC records present
- Open Ports: None detected
- TLS Certificates: None
- Service Status: Inactive/Firewalled
---
## Historical Observations (14 Events)
Recent signal history indicates:
- Ownership Attribution: Consistent VIETTEL-VN attribution across multiple observations
- Geolocation: Primary location Bien Hoa, Vietnam with occasional variations
- Recent Activity: Port scanning activity observed (signal type 8)
- Persistence: No persistent malicious behavior detected
---
## Subnet Analysis
- Subnet: 115.76.49.0/24
- Abuse Density: 0.0 (Low)
- Neighbor Risk: One sibling IP (115.76.49.46) with matching risk score of 40
- Threat Siblings: 0
- Active Siblings: 0
---
## Related Entities
- Network Association: VIETTEL-VN
- DNS Associations: adsl.viettel.vn (multiple records)
---
## Recommended Security Actions
Firewall Rules:
| Platform | Rule |
|---|---|
| **iptables** | `iptables -A INPUT -s 115.76.49.6 -j DROP` |
| **nftables** | `nft add rule inet filter input ip saddr 115.76.49.6 drop` |
| **nginx** | `deny 115.76.49.6;` |
| **pfSense** | Block `115.76.49.6/32` |
| **Cloudflare WAF** | Block with expression `ip.src eq 115.76.49.6` |
| **AWS WAF** | Add `115.76.49.6/32` to block list |
---
## Intelligence Assessment
This IP belongs to Viettel, a major Vietnamese telecommunications provider. The moderate risk score (40) combined with DNSBL listings suggests the IP has been involved in prior abuse activity. However, no active threat indicators, known campaigns, or persistent malicious behavior are currently observed.
Recommended Actions:
- Monitor for increased abuse activity in the /24 subnet
- Consider temporary blocking if traffic patterns indicate abuse
- Review historical threat data for correlation with known threat actors
- Investigate associated IP 115.76.49.46 for similar risk characteristics
Confidence Level: Moderate - Risk assessment based on historical abuse patterns and DNSBL listings rather than active threat indicators.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | IRT-VNNIC-AP |
| ASN | AS7552 |
| Network Name | VIETTEL-VN |
| CIDR Block | 115.72.0.0/13 |
| RIR | APNIC |
| Country | VN |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | adsl.viettel.vn |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | adsl.viettel.vn |
🔐 DNS Hygiene
| Hygiene Score | 60% (Good) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🛡️ Public Network Snapshot
| Origin ASN | AS7552 |
| Network Prefix | 115.76.49.0/24 |
| Route mapping | Found |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 25% | 1 | 1 |
| routing | 25% | 1 | 1 |
| services | 25% | 1 | 1 |
| ownership | 0% | 0 | 0 |
| reputation | 0% | 0 | 0 |
| geolocation | 0% | 0 | 0 |
| Overall | 12% | 3 | 3 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Low (35%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-17 23:21:04 UTC |
| Last Seen | 2026-09-02 21:36:25 UTC |
| Profile Built | 2026-09-02 21:38:01 UTC |
| Data Freshness | Live |
| Signal Types | 23 |
| Total Observations | 24 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 115.76.49.6
Who owns the IP address 115.76.49.6?
115.76.49.6 is registered to IRT-VNNIC-AP. The address falls within the 115.72.0.0/13 network block. Registration is held at APNIC.
Where is 115.76.49.6 located?
Geolocation data places 115.76.49.6 in Bien Hoa, 39, Vietnam. The local time zone is Asia/Ho_Chi_Minh. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 115.76.49.6 malicious or safe?
115.76.49.6 currently carries a moderate risk assessment, meaning some indicators warrant caution, but the evidence is mixed. This assessment is generated from continuously collected signals and can change over time.
What is the hostname for 115.76.49.6?
The reverse DNS (PTR) record for 115.76.49.6 is adsl.viettel.vn. This hostname is not forward-confirmed, so it should be treated as a weak signal.