116.110.149.157📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 116.110.149.157/32

Date: 2026-07-23

Classification: Moderate Risk (Score: 55/100)

---

## EXECUTIVE SUMMARY

IP 116.110.149.157 is a Vietnamese Internet Service Provider (ISP) infrastructure address associated with Viettel Corporation. The IP exhibits moderate risk characteristics with no active malicious indicators but warrants monitoring due to elevated risk score and neighborhood abuse density.

---

## OWNERSHIP & GEOSLOCATION

• ASN: 24086 (IRT-VNNIC-AP)
• Organization: VIETTEL-VN (Viettel Corporation)
• Network Block: 116.96.0.0/12
• Geolocation: Vietnam (VN), Da Nang
• RIR: APNIC
• BGP Origin: 116.110.144.0/21
• AS Path: 2914 → 7552 → 24086 → 24086

---

## THREAT ASSESSMENT

Risk Score: 55/100 (Moderate)

Control Plane Observations:

• Route stability: Unstable (1 route change in 30 days)
• RPKI Status: Not validated
• MOAS (Multiple Origin ASN Source): No

---

## NETWORK PROFILE

Services: Firewalled / No Services Detected

• Open Ports: None
• TLS Certificate: None
• HTTP Services: None
• DNS PTR Records: None
• Forward Resolution: 0 records

---

## SUBNET ANALYSIS (116.110.149.0/24)

• Abuse Density: 0.2222 (Moderate)
• Classification: Mixed
• Total Siblings: 9
• Active Siblings: 1
• Threat Siblings: 2

High-Risk Neighbors:

• 116.110.149.111 (Risk: 55)
• 116.110.149.136 (Risk: 55)

---

## OBSERVATION HISTORY

Total observations: 15 (Recent: 2026-07-23)

• Ownership Changes: 0 (Stable)
• Threat Persistence: 0 days
• BGP Route Changes: 1 (30-day window)
• Threat Observation Count: 0

Recent signals indicate BGP prefix updates and network classification assessments. No persistent malicious activity detected.

---

## RELATIONSHIP GRAPH

Primary relationship: Same Network (VIETTEL-VN)

• 4 relationship entries confirm Viettel network association
• No external entity correlations identified

---

## RECOMMENDED ACTIONS

Primary Recommendation: Monitor and potentially block traffic from this IP due to elevated risk score.

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 116.110.149.157 -j DROP

# nftables

nft add rule inet filter input ip saddr 116.110.149.157 drop

# nginx

deny 116.110.149.157;

```

Cloud Security Recommendations:

• Cloudflare WAF: Block rule configured for 116.110.149.157
• AWS WAF: Address set to 116.110.149.157/32 with description "IPDebrief risk 55"

---

## ANALYST NOTES

1. No Active Exploitation: Despite moderate risk score, no active threat indicators detected

2. ISP Infrastructure: This is a legitimate ISP address range; consider whitelist if internal network traffic is expected

3. Neighborhood Context: Two threat siblings in subnet warrant monitoring of adjacent addresses

4. Route Instability: BGP route changes may indicate network reconfiguration or potential hijack attempts

Priority: Medium – Monitor but consider blocking if no legitimate business use case exists.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.