# 115.79.196.94 — IP Intelligence Summary

115.79.196.94 is an IPv4 address operated by IRT-VNNIC-AP (AS7552), geolocated to Ho Chi Minh City, Vietnam. As of September 3, 2026, IPDebrief rates it Moderate Risk (55/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/115.79.196.94
- Last updated: 2026-09-03

## Ownership

- Organization: IRT-VNNIC-AP
- Network name: VIETTEL-VN
- Allocated block: 115.72.0.0/13
- ASN: AS7552 (https://ipdebrief.com/asn/7552)
- Regional registry: APNIC

## Location

- City: Ho Chi Minh City
- Region: Ho Chi Minh
- Country: Vietnam
- Time zone: Asia/Ho_Chi_Minh

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (55/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Exposed services

- 80/tcp — http
- 443/tcp — https
- 22/tcp — ssh
- 8443/tcp — https-alt

## Analyst narrative

\# IP INTELLIGENCE BRIEFING: 115.79.196.94/32

\## EXECUTIVE SUMMARY

IP 115.79.196.94 presents a **Moderate Risk** profile (Risk Score: 55/100) with significant geolocation inconsistencies and DNSBL listings. The IP is associated with Viettel infrastructure (AS7552) but exhibits conflicting country indicators between Vietnam and United Kingdom. Recommended actions include increased logging and blocking via perimeter defenses.

\---

\## OWNERSHIP & NETWORK CLASSIFICATION

| Attribute | Value |

|-----------|-------|

| **ASN** | 7552 (IRT-VNNIC-AP) |

| **Organization** | VIETTEL-VN |

| **CIDR Block** | 115.72.0.0/13 |

| **RIR** | APNIC |

| **Network Role** | Firewalled / No Services |

| **Service Purpose** | No active services detected |

\---

\## GEOLOCATION DISCREPANCY ALERT

**Critical Finding:** Geographic data shows conflicting indicators requiring analyst review:

\- **Current Profile:** GB (London, Tran Huu Duc street, My Dinh)

\- **Historical Signals:** VN (Vietnam, coordinates 14.06, 108.28)

\- **Consensus:** GeoPlausible = FALSE

This inconsistency suggests potential IP spoofing, misconfigured servers, or legitimate infrastructure with multiple geographic footprints.

\---

\## THREAT INDICATORS

\- **Blacklist Status:** Listed on 3 of 8 DNSBL checks

\- **Known Attacker:** FALSE

\- **Tor Exit Node:** FALSE

\- **Spam Source:** FALSE

\- **Known Campaigns:** None identified

\- **Abuse Confidence Score:** Not calculated

\---

\## NETWORK BEHAVIOR & SERVICES

\- **Open Ports:** None detected (firewalled)

\- **TLS Certificate:** Present (TLS 1.3, cipher: TLS_AES_256_GCM_SHA384)

\- **SSH Banner:** SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.16

\- **Server Banner:** nginx

\- **HTTP Services:** None active

\- **DNS Records:** No PTR hostnames, forward resolution confirmed FALSE

\---

\## NEIGHBORHOOD ANALYSIS

\- **Subnet:** 115.79.196.94/24

\- **Neighbor Count:** 0

\- **Abuse Density:** 0

\- **Risk Distribution:** No high/medium/low risk neighbors detected

\- **Classification:** Insufficient data for subnet-level assessment

\---

\## CONTROL PLANE ANALYSIS

\- **Route Stability:** FALSE (isRouteStable = false)

\- **RPKI State:** Not available

\- **IRR Consistency:** Not available

\- **Route Changes (30d):** 0

\- **DNSSEC:** Valid

\- **HSTS:** FALSE

\- **CSP:** FALSE

\- **Traceroute:** 18 hops, 5 timed out, transit via Comcast/Cogent

\---

\## OBSERVATION HISTORY (Last 12 Signals)

Recent activity detected on 2026-07-27:

1. **Geolocation:** Vietnam (confidence 0.52, 600km accuracy)

2. **TLS/Ports:** SSH, nginx detected with TLS 1.3

3. **Network Data:** ASN 7552, CIDR 115.72.0.0/13 confirmed

4. **Operator Score:** 0.1304 (Minimal)

\---

\## RECOMMENDED SECURITY ACTIONS

\### Immediate Actions

1. **Block at Perimeter:** Implement blocking rules across all infrastructure

2. **Increase Logging:** Monitor all traffic from this IP with elevated verbosity

\### Firewall Implementation

**iptables:**

\`\`\`

iptables -A INPUT -s 115.79.196.94 -j DROP

\`\`\`

**nftables:**

\`\`\`

nft add rule inet filter input ip saddr 115.79.196.94 drop

\`\`\`

**nginx:**

\`\`\`

deny 115.79.196.94;

\`\`\`

**pfSense:**

\`\`\`

115.79.196.94/32

\`\`\`

**Cloudflare WAF:**

\`\`\`json

{

"description": "Block 115.79.196.94 — IPDebrief risk score 55",

"action": "block",

"filter": {

"expression": "ip.src eq 115.79.196.94"

}

}

\`\`\`

**AWS WAF:**

\`\`\`json

{

"Addresses": \["115.79.196.94/32"\],

"Description": "IPDebrief risk 55"

}

\`\`\`

\---

\## INTELLIGENCE ASSESSMENT

This IP demonstrates moderate risk characteristics with geolocation inconsistencies that warrant further investigation. The presence of SSH and nginx services despite being classified as "firewalled" suggests potential misconfiguration or stealth operations. The route instability and DNSBL listings indicate prior abuse history. No evidence of active threat campaigns or known malicious behavior detected. Recommend monitoring for service changes and geolocation updates while maintaining defensive blocking posture.

**Priority:** MEDIUM

**Action Required:** BLOCK + MONITOR

## Nearby addresses

- 115.79.196.11 (https://ipdebrief.com/115.79.196.11)

---

Source: IPDebrief, "115.79.196.94 IP intelligence", https://ipdebrief.com/115.79.196.94, updated 2026-09-03. Assessments are probabilistic.