154.117.199.5📋 Copy

IP INTELLIGENCE BRIEFING

Target IP: 154.117.199.5/32

Executive Summary: Low-risk, passive infrastructure IP with no active services. Associated with Viettel Burundi SA (ASN 327799). No active threat indicators detected, but subnet-level abuse density requires monitoring.

---

Ownership & Geolocation

• Organization: Vo Trung Thanh / Viettel Burundi SA
• ASN: 327799 (Afrinic, allocated 2015-04-23)
• CIDR Block: 154.117.196.0 - 154.117.199.255 (154.117.199.5/32)
• Location: Bujumbura, Bujumbura Mairie Province, Burundi (BI)
• Coordinates: -3.5° latitude, 30° longitude

Risk Assessment

• Overall Risk Score: 25 (Low Risk)
• Abuse Confidence Score: Not applicable (no active threat activity)
• Provider/Authority Scores: 0 (neutral)
• Risk Classification: Low Risk

Network State & Services

• Open Ports: None detected
• Service Status: Firewalled / No Services
• TLS Certificates: None
• DNS Resolution: No PTR hostnames, no forward resolution
• Hosted Domains: 0
• Email Auth: No SPF/DMARC records

Threat Indicators

• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Blacklist Count: 0
• Threat Feeds: None
• Campaign Correlation: No matches

Control Plane & Routing

• Route Stability: False (route changes detected)
• BGP Prefix: 154.117.192.0/18
• DNSSEC: Valid
• DNSBL Status: Listed on 1 of 8 total lists
• RPKI State: Not evaluated

Neighborhood Analysis (154.117.199.0/24)

• Abuse Density: 0.5 (moderate)
• Classification: Mostly Clean
• Total Siblings: 2
• Active Siblings: 0
• Threat Siblings: 1
• Neighbor Risk: 154.117.199.56 identified with risk score 65 (medium-high)

Relationship Graph

• Network Associations: 15 relationships to same network (154.117.196.0 - 154.117.199.255)
• No Hostname/Organization/Certificate Links: No external entity associations detected

Historical Observation (16 records)

• ASN Consistency: 327799 (Viettel Burundi SA) - stable
• Geolocation: Consistent Burundi (BI)
• Subnet Abuse Density: 0.5 (observed 2026-06-17)
• Threat Persistence: 0 days (not persistently malicious)

---

SOC Analyst Recommendations

1. Block/Filter Decision: LOW PRIORITY - No immediate threat. IP is passive with no services.

2. Monitoring: Monitor subnet 154.117.199.0/24 due to elevated neighbor risk (154.117.199.56, score 65).

3. Firewall Rules: No specific blocking required at this time. Consider passive monitoring for outbound connections from this IP.

4. Threat Hunting: No active indicators. Focus investigation on related IP 154.117.199.56 which shows elevated risk.

---

Classification: LOW RISK / PASSIVE INFRASTRUCTURE

Last Updated: Analysis based on IPDebrief intelligence data

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.