# 116.110.158.222 — IP Intelligence Summary

116.110.158.222 is an IPv4 address operated by IRT-VNNIC-AP (AS24086), geolocated to Da Nang, Vietnam. As of October 12, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/116.110.158.222
- Last updated: 2026-10-12

## Ownership

- Organization: IRT-VNNIC-AP
- Network name: VIETTEL-VN
- Allocated block: 116.96.0.0/12
- ASN: AS24086 (https://ipdebrief.com/asn/24086)
- Regional registry: APNIC

## Location

- City: Da Nang
- Region: Da Nang
- Country: Vietnam
- Time zone: Asia/Ho_Chi_Minh

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (40/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP INTELLIGENCE BRIEFING

**Target**: 116.110.158.222/32

**Classification**: Moderate Risk (Score: 40/100)

**Status**: Provider Infrastructure – Monitor for Anomalies

\---

\## EXECUTIVE SUMMARY

IP 116.110.158.222 is a Vietnamese ISP infrastructure address under Viettel Corporation (IRT-VNNIC-AP, ASN 24086). The IP is assigned to a legitimate telecommunications provider with moderate risk scoring. While not currently flagged as malicious, the address warrants continued monitoring due to its classification within a provider network with mixed neighborhood risk indicators.

\---

\## OWNERSHIP AND GEOSPATIAL ANALYSIS

| Attribute | Value |

|-----------|-------|

| **Organization** | IRT-VNNIC-AP (Viettel) |

| **ASN** | 24086 |

| **Network** | 116.96.0.0/12 |

| **Country** | Vietnam (VN) |

| **Region** | Tran Huu Duc street, My Dinh |

| **City** | No 1 |

| **Timezone** | Asia/Ho_Chi_Minh |

| **RIR** | APNIC |

**Geolocation Confidence**: Geo consensus confirmed across multiple sources. Historical observations (11 total) show consistent assignment to Vietnamese ISP infrastructure.

\---

\## THREAT INTELLIGENCE ASSESSMENT

**Current Risk Profile:**

\- **Risk Score**: 40 (Moderate)

\- **Abuse Confidence**: Not assessed

\- **Blacklist Status**: 0 lists

\- **Tor Exit Node**: No

\- **Known Attacker**: No

\- **Spam Source**: No

**Threat Indicators**: None detected. No active campaign correlations, certificate matches, or correlated IPs identified.

**Network Role**: Provider network with firewalled/no services detected. Not classified as cloud, CDN, VPN, proxy, Tor, hosting, or mobile infrastructure.

\---

\## NEIGHBORHOOD ANALYSIS (Subnet: 116.110.158.0/24)

**Subnet Classification**: Mostly Clean

**Abuse Density**: 16.67% (0.1667)

**Total Siblings**: 6

**Active Siblings**: 5

**Threat Siblings**: 1

**Neighbor Risk Distribution**:

| IP Address | Risk Score | Authority Score | Classification |

|------------|------------|-----------------|----------------|

| 116.110.158.50 | 15 | 50 | Low |

| 116.110.158.67 | 25 | 50 | Low |

| 116.110.158.101 | 55 | 50 | Medium |

| 116.110.158.146 | 55 | 50 | Medium |

| 116.110.158.220 | 25 | 50 | Low |

**Observation**: The /24 subnet shows low-to-moderate abuse density. One neighbor (116.110.158.101/146) exhibits medium risk scores (55), suggesting potential localized abuse activity requiring correlation analysis.

\---

\## INFRASTRUCTURE AND SERVICES

**Services Detected**: None (Firewalled/No Services)

**Open Ports**: None

**DNS Records**: No PTR hostnames, no forward resolution, no hosted domains

**Email Auth**: SPF/DMARC not configured

**HTTP Services**: No TLS certificates, no banner detection

**Control Plane**:

\- **BGP Prefix**: 116.110.152.0/21

\- **Route Stability**: False

\- **RPKI State**: Not assessed

\- **IRR Consistency**: Not assessed

\---

\## OBSERVATION HISTORY

**Total Observations**: 11 signals

**Recent Activity**: July 23, 2026

**Key Signals**:

\- Ownership registration: APNIC, Viettel infrastructure

\- Geolocation: Ho Chi Minh City region

\- Operator Score: 0.1304 (Minimal)

\- Threat Persistence: 0 days

**Temporal Analysis**: No ownership changes detected. Threat observation count remains at zero, indicating no persistent malicious activity observed to date.

\---

\## RECOMMENDED ACTIONS

**Firewall/Blocking Rules**:

\`\`\`bash

\# iptables

iptables -A INPUT -s 116.110.158.222 -j DROP

\# nftables

nft add rule inet filter input ip saddr 116.110.158.222 drop

\# nginx

deny 116.110.158.222;

\# pfSense

116.110.158.222/32

\# Cloudflare WAF

ip.src eq 116.110.158.222 → BLOCK

\# AWS WAF

Addresses: \["116.110.158.222/32"\]

Description: IPDebrief risk 40

\`\`\`

**Mitigation Notes**:

\- Provider network IP – blocking may impact legitimate traffic from Viettel infrastructure

\- Consider rate-limiting rather than blocking if traffic is observed

\- Monitor for any changes in risk score or threat indicators

\- Correlate with 116.110.158.101 and 116.110.158.146 (medium-risk neighbors)

\---

\## RISK ASSESSMENT SUMMARY

| Criterion | Assessment |

|-----------|------------|

| **Malicious Activity** | Not detected |

| **Reputation** | Moderate (40/100) |

| **Infrastructure Legitimacy** | Confirmed (ISP Provider) |

| **Neighborhood Risk** | Low-Moderate |

| **Urgency** | Low – Monitor |

**Final Recommendation**: Continue monitoring. No immediate threat indicators present. Apply defensive rules if required by organizational policy, but consider whitelist exceptions for legitimate Viettel infrastructure traffic.

\---

*Report generated: IPDebrief Intelligence Platform*

## Nearby addresses

- 116.110.158.45 (https://ipdebrief.com/116.110.158.45)
- 116.110.158.50 (https://ipdebrief.com/116.110.158.50)
- 116.110.158.65 (https://ipdebrief.com/116.110.158.65)
- 116.110.158.67 (https://ipdebrief.com/116.110.158.67)
- 116.110.158.101 (https://ipdebrief.com/116.110.158.101)
- 116.110.158.146 (https://ipdebrief.com/116.110.158.146)
- 116.110.158.190 (https://ipdebrief.com/116.110.158.190)
- 116.110.158.198 (https://ipdebrief.com/116.110.158.198)
- 116.110.158.205 (https://ipdebrief.com/116.110.158.205)
- 116.110.158.220 (https://ipdebrief.com/116.110.158.220)
- 116.110.158.224 (https://ipdebrief.com/116.110.158.224)

---

Source: IPDebrief, "116.110.158.222 IP intelligence", https://ipdebrief.com/116.110.158.222, updated 2026-10-12. Assessments are probabilistic.