116.110.158.222📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 116.110.158.222/32

Classification: Moderate Risk (Score: 40/100)

Status: Provider Infrastructure – Monitor for Anomalies

---

## EXECUTIVE SUMMARY

IP 116.110.158.222 is a Vietnamese ISP infrastructure address under Viettel Corporation (IRT-VNNIC-AP, ASN 24086). The IP is assigned to a legitimate telecommunications provider with moderate risk scoring. While not currently flagged as malicious, the address warrants continued monitoring due to its classification within a provider network with mixed neighborhood risk indicators.

---

## OWNERSHIP AND GEOSPATIAL ANALYSIS

Geolocation Confidence: Geo consensus confirmed across multiple sources. Historical observations (11 total) show consistent assignment to Vietnamese ISP infrastructure.

---

## THREAT INTELLIGENCE ASSESSMENT

Current Risk Profile:

• Risk Score: 40 (Moderate)
• Abuse Confidence: Not assessed
• Blacklist Status: 0 lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

Threat Indicators: None detected. No active campaign correlations, certificate matches, or correlated IPs identified.

Network Role: Provider network with firewalled/no services detected. Not classified as cloud, CDN, VPN, proxy, Tor, hosting, or mobile infrastructure.

---

## NEIGHBORHOOD ANALYSIS (Subnet: 116.110.158.0/24)

Subnet Classification: Mostly Clean

Abuse Density: 16.67% (0.1667)

Total Siblings: 6

Active Siblings: 5

Threat Siblings: 1

Neighbor Risk Distribution:

Observation: The /24 subnet shows low-to-moderate abuse density. One neighbor (116.110.158.101/146) exhibits medium risk scores (55), suggesting potential localized abuse activity requiring correlation analysis.

---

## INFRASTRUCTURE AND SERVICES

Services Detected: None (Firewalled/No Services)

Open Ports: None

DNS Records: No PTR hostnames, no forward resolution, no hosted domains

Email Auth: SPF/DMARC not configured

HTTP Services: No TLS certificates, no banner detection

Control Plane:

• BGP Prefix: 116.110.152.0/21
• Route Stability: False
• RPKI State: Not assessed
• IRR Consistency: Not assessed

---

## OBSERVATION HISTORY

Total Observations: 11 signals

Recent Activity: July 23, 2026

Key Signals:

• Ownership registration: APNIC, Viettel infrastructure
• Geolocation: Ho Chi Minh City region
• Operator Score: 0.1304 (Minimal)
• Threat Persistence: 0 days

Temporal Analysis: No ownership changes detected. Threat observation count remains at zero, indicating no persistent malicious activity observed to date.

---

## RECOMMENDED ACTIONS

Firewall/Blocking Rules:

```bash

# iptables

iptables -A INPUT -s 116.110.158.222 -j DROP

# nftables

nft add rule inet filter input ip saddr 116.110.158.222 drop

# nginx

deny 116.110.158.222;

# pfSense

116.110.158.222/32

# Cloudflare WAF

ip.src eq 116.110.158.222 → BLOCK

# AWS WAF

Addresses: ["116.110.158.222/32"]

Description: IPDebrief risk 40

```

Mitigation Notes:

• Provider network IP – blocking may impact legitimate traffic from Viettel infrastructure
• Consider rate-limiting rather than blocking if traffic is observed
• Monitor for any changes in risk score or threat indicators
• Correlate with 116.110.158.101 and 116.110.158.146 (medium-risk neighbors)

---

## RISK ASSESSMENT SUMMARY

Final Recommendation: Continue monitoring. No immediate threat indicators present. Apply defensive rules if required by organizational policy, but consider whitelist exceptions for legitimate Viettel infrastructure traffic.

---

*Report generated: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.