116.105.73.162📋 Copy

# INTELLIGENCE BRIEFING: 116.105.73.162/32

Classification: Moderate Risk

Date: 2026-07-29

Prepared For: SOC Operations

---

## EXECUTIVE SUMMARY

IP 116.105.73.162 is classified as MODERATE RISK (Risk Score: 40) with origin in Vietnam (Da Nang). The IP belongs to VIETTEL-VN (ASN 24086), a Vietnamese ISP. No active services are detected; the IP appears firewalled with no open ports. The IP is listed on 2 of 8 DNSBL entries. No malicious activity indicators observed in current observation window.

---

## NETWORK ATTRIBUTION

---

## THREAT ASSESSMENT

Network Classification: Residential / No Services Detected (Service Purpose: "Firewalled / No Services")

---

## OBSERVATION HISTORY

Total Observations: 13

Most Recent Activity: 2026-07-29 12:20 UTC

Key signals observed include:

• Geolocation inference (Vietnam, confidence: 0.52)
• Network classification (confidence: 0.30)
• Operator routing assessment (confidence: 0.30)
• Multi-dimensional risk assessment (confidence: 0.17)

Threat Persistence: 0 days (no persistent malicious activity)

Ownership Changes: 0

---

## NEIGHBORHOOD ANALYSIS

Subnet: 116.105.73.162/24

• Abuse Density: 0%
• Total Siblings: 0
• Active Siblings: 0
• Threat Siblings: 0
• Risk Distribution: None detected

The IP appears isolated within its /24 subnet with no adjacent abuse activity.

---

## RELATIONSHIP GRAPH

Direct Relationships: 3

• All classified as "Same Network" → VIETTEL-VN

No certificates, hostnames, or organizational links detected beyond network attribution.

---

## SERVICE & DNS ANALYSIS

---

## RECOMMENDED ACTIONS

Firewall Blocking Recommended:

```bash

# iptables

iptables -A INPUT -s 116.105.73.162 -j DROP

# nftables

nft add rule inet filter input ip saddr 116.105.73.162 drop

# nginx

deny 116.105.73.162;

# pfSense

116.105.73.162/32

# Cloudflare WAF

Block 116.105.73.162 — IPDebrief risk score 40

# AWS WAF

Addresses: 116.105.73.162/32 — Description: IPDebrief risk 40

```

---

## ANALYST NOTES

1. Low-Activity Profile: No services detected, no open ports, no DNS forward resolution. Consistent with residential or low-traffic endpoint.

2. DNSBL Presence: Listed on 2 of 8 DNSBLs warrants monitoring but does not indicate confirmed malicious activity.

3. Route Instability: BGP route flagged as unstable (isRouteStable: false). May indicate dynamic peering or routing changes.

4. Neighborhood Clean: Zero threat siblings in /24 subnet. No cluster abuse indicators.

5. Recommendation: Monitor for pattern emergence. Current threat indicators insufficient for immediate block without additional context (e.g., connection attempts, payload analysis). Apply blocking rules with logging enabled for future correlation.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.