117.5.143.173📋 Copy

## IP INTELLIGENCE BRIEFING: 117.5.143.173/32

EXECUTIVE SUMMARY

IP address 117.5.143.173 is classified as High Risk (Score: 70/100). The address is associated with Viettel-VN (Vietnam), operates within the 117.5.0.0/16 block, and shows no active services despite the elevated risk designation. Recommended action: Block immediately and monitor for anomalous activity.

---

NETWORK OWNERSHIP & INFRASTRUCTURE

• Organization: IRT-VNNIC-AP (Vietnam)
• NetName: VIETTEL-VN
• ASN: 7552
• CIDR Block: 117.5.0.0/16
• RIR: APNIC
• Abuse Contact: Available via RDAP

The IP is registered to Viettel, Vietnam's state-owned telecommunications operator. The network infrastructure shows minimal operator activity with an operator score of 0.1304 (Minimal).

---

GEOLOCATION ANALYSIS

• Country: Vietnam (VN)
• Region: 14
• City: Hoa Binh
• Coordinates: 14.06°N, 108.28°E
• Accuracy Radius: 600km
• GeoValidation: Inconsistencies detected (geoPlausible: false)
• Timezone: Asia/Ho_Chi_Minh

Multiple geolocation signals converge on Vietnam with 600km accuracy. Forward resolution to "localhost" detected but forward confirmation failed.

---

THREAT PROFILE & RISK INDICATORS

• Overall Risk Score: 70/100 (High Risk)
• Threat Indicators: None directly observed
• Blacklist Status: 0 blacklists
• Campaign Affiliation: None identified
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• DNSBL Listed: 4 out of 8 total lists
• Reputation: High Risk

The elevated risk score (70) contrasts with zero direct threat indicators. The risk appears derived from reputation scoring rather than observed malicious activity.

---

SERVICE & DNS ANALYSIS

• Open Ports: None detected
• Service Classification: Firewalled / No Services
• DNS PTR Record: localhost
• Forward Resolution: localhost (1 record)
• Email Authentication: No SPF, DMARC, or TXT records
• TLS Certificate: None
• HTTP Banner: None

No active services detected on the IP. The hostname resolution to "localhost" suggests either a misconfigured system, a honeypot, or a non-productive host.

---

HISTORICAL OBSERVATIONS (16 Total)

Recent observation history (2026-07-22) shows:

• Subnet Classification: Clean (inherited risk: 0)
• Abuse Density: 0
• Geolocation Signals: Vietnam (confidence 0.52)
• Network Classification: Non-residential, non-cloud, non-proxy
• Operator Score: 0.1304 (Minimal)
• Route Stability: False

Observations indicate inconsistent classification signals with the current high-risk profile.

---

NEIGHBORHOOD ANALYSIS (Subnet: 117.5.143.0/24)

• Total Siblings: 1 active neighbor
• Abuse Density: 0
• Risk Distribution: 1 medium-risk neighbor
• Neighbor IP: 117.5.143.102 (Risk Score: 40/100, Authority Score: 50/100)

The /24 subnet shows minimal abuse activity. One neighboring IP (117.5.143.102) presents moderate risk (40).

---

NETWORK RELATIONSHIPS

• Same Network Associations: 3 instances linked to VIETTEL-VN
• DNS Associations: 3 instances resolved to localhost
• Campaign Correlations: 0 correlated IPs
• Certificate Matches: 0

No significant external relationships detected beyond network-level associations with Viettel infrastructure.

---

RECOMMENDED ACTIONS

IMMEDIATE:

• Block IP: Add 117.5.143.173/32 to firewall deny lists (iptables, nftables, pfSense, nginx, Cloudflare WAF, AWS WAF)
• Monitor: Increase logging verbosity for traffic from this IP range
• Investigate: Review any recent connections to this address for anomalous patterns

PRIORITY: High

The high-risk designation warrants defensive action despite the absence of direct threat indicators. The combination of Vietnam-based Viettel infrastructure, elevated risk score, and localhost-only DNS resolution warrants blocking to prevent potential abuse or reconnaissance activity.

---

Report Generated: [Current Time]

Intelligence Source: IPDebrief®

Classification: Defensive Security Intelligence

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.