115.79.196.94📋 Copy

# IP INTELLIGENCE BRIEFING: 115.79.196.94/32

## EXECUTIVE SUMMARY

IP 115.79.196.94 presents a Moderate Risk profile (Risk Score: 55/100) with significant geolocation inconsistencies and DNSBL listings. The IP is associated with Viettel infrastructure (AS7552) but exhibits conflicting country indicators between Vietnam and United Kingdom. Recommended actions include increased logging and blocking via perimeter defenses.

---

## OWNERSHIP & NETWORK CLASSIFICATION

---

## GEOLOCATION DISCREPANCY ALERT

Critical Finding: Geographic data shows conflicting indicators requiring analyst review:

• Current Profile: GB (London, Tran Huu Duc street, My Dinh)
• Historical Signals: VN (Vietnam, coordinates 14.06, 108.28)
• Consensus: GeoPlausible = FALSE

This inconsistency suggests potential IP spoofing, misconfigured servers, or legitimate infrastructure with multiple geographic footprints.

---

## THREAT INDICATORS

• Blacklist Status: Listed on 3 of 8 DNSBL checks
• Known Attacker: FALSE
• Tor Exit Node: FALSE
• Spam Source: FALSE
• Known Campaigns: None identified
• Abuse Confidence Score: Not calculated

---

## NETWORK BEHAVIOR & SERVICES

• Open Ports: None detected (firewalled)
• TLS Certificate: Present (TLS 1.3, cipher: TLS_AES_256_GCM_SHA384)
• SSH Banner: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.16
• Server Banner: nginx
• HTTP Services: None active
• DNS Records: No PTR hostnames, forward resolution confirmed FALSE

---

## NEIGHBORHOOD ANALYSIS

• Subnet: 115.79.196.94/24
• Neighbor Count: 0
• Abuse Density: 0
• Risk Distribution: No high/medium/low risk neighbors detected
• Classification: Insufficient data for subnet-level assessment

---

## CONTROL PLANE ANALYSIS

• Route Stability: FALSE (isRouteStable = false)
• RPKI State: Not available
• IRR Consistency: Not available
• Route Changes (30d): 0
• DNSSEC: Valid
• HSTS: FALSE
• CSP: FALSE
• Traceroute: 18 hops, 5 timed out, transit via Comcast/Cogent

---

## OBSERVATION HISTORY (Last 12 Signals)

Recent activity detected on 2026-07-27:

1. Geolocation: Vietnam (confidence 0.52, 600km accuracy)

2. TLS/Ports: SSH, nginx detected with TLS 1.3

3. Network Data: ASN 7552, CIDR 115.72.0.0/13 confirmed

4. Operator Score: 0.1304 (Minimal)

---

## RECOMMENDED SECURITY ACTIONS

Immediate Actions

1. Block at Perimeter: Implement blocking rules across all infrastructure

2. Increase Logging: Monitor all traffic from this IP with elevated verbosity

Firewall Implementation

iptables:

```

iptables -A INPUT -s 115.79.196.94 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 115.79.196.94 drop

```

nginx:

```

deny 115.79.196.94;

```

pfSense:

```

115.79.196.94/32

```

Cloudflare WAF:

```json

{

"description": "Block 115.79.196.94 — IPDebrief risk score 55",

"action": "block",

"filter": {

"expression": "ip.src eq 115.79.196.94"

}

}

```

AWS WAF:

```json

{

"Addresses": ["115.79.196.94/32"],

"Description": "IPDebrief risk 55"

}

```

---

## INTELLIGENCE ASSESSMENT

This IP demonstrates moderate risk characteristics with geolocation inconsistencies that warrant further investigation. The presence of SSH and nginx services despite being classified as "firewalled" suggests potential misconfiguration or stealth operations. The route instability and DNSBL listings indicate prior abuse history. No evidence of active threat campaigns or known malicious behavior detected. Recommend monitoring for service changes and geolocation updates while maintaining defensive blocking posture.

Priority: MEDIUM

Action Required: BLOCK + MONITOR

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.