163.44.193.24📋 Copy

# IP Intelligence Briefing: 163.44.193.24

Classification: High Risk (Score: 80/100)

Date: Analysis current

Region: Vietnam (VN)

---

## Executive Summary

IP 163.44.193.24 presents an elevated threat profile with a risk score of 80/100. The address is registered to IRT-VNNIC-AP under RUNSYSTEM-VN (ASN 131392) within the 163.44.192.0/22 CIDR block. Current services show as firewalled with no open ports. The IP is listed on 4 of 8 DNSBLs and demonstrates unstable routing behavior.

---

## Technical Profile

Ownership & Registration:

• ASN: 131392
• Organization: IRT-VNNIC-AP
• Network: RUNSYSTEM-VN
• CIDR: 163.44.192.0/22
• RIR: APNIC

Geolocation:

• Country: Vietnam (VN)
• Coordinates: 14.06°N, 108.28°E (600km accuracy radius)
• Timezone: Asia/Ho_Chi_Minh

DNS Resolution:

• PTR Hostname: v163-44-193-24.a002.g.han1.static.cnode.io
• Domain: cnode.io
• Forward resolution: Confirmed

Network Services:

• Open Ports: None detected
• Service Status: Firewalled / No Services
• TLS Certificate: Not detected

Control Plane:

• BGP Prefix: 163.44.192.0/22
• Route Stability: Unstable
• DNSSEC: Valid
• DNSBL Listings: 4/8 total lists

---

## Threat Indicators

Current Status:

• Risk Score: 80/100 (High Risk)
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0 (direct threat feeds)
• Honeypot Hits: 0

Risk Breakdown:

• Operator Score: 0.2609 (Basic classification)
• Abuse Confidence: Not quantified
• Threat Persistence: 0 days observed

---

## Observation History

15 signal observations recorded. Recent activity (2026-07-22) shows:

• Consistent Vietnam geolocation attribution
• Organization registered as IRT-VNNIC-AP
• Abuse contact: hm-changed@vnnic.vn
• Operator classification remained "Basic"
• No significant signal type changes observed

Temporal analysis indicates no persistent malicious behavior patterns. Ownership and threat observation counts remain at zero.

---

## Network Relationships

Direct Associations:

• Network: RUNSYSTEM-VN (Same Network)
• Hostnames: v163-44-193-24.a002.g.han1.static.cnode.io (DNS)

Subnet Analysis:

• /24 Subnet: 163.44.193.24/24
• Neighbors: 0 detected
• Abuse Density: 0
• Classification: No inherited risk from neighbors

---

## Recommended Actions

Immediate:

1. Block/Drop Traffic from 163.44.193.24/32 across all ingress points

2. Increase logging verbosity for traffic from this IP to monitor for changes

3. Review recent activity to establish baseline behavior

Firewall Rules:

• iptables: `iptables -A INPUT -s 163.44.193.24 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 163.44.193.24 drop`
• nginx: `deny 163.44.193.24;`
• pfSense: `163.44.193.24/32`
• Cloudflare WAF: Block with description "IPDebrief risk score 80"
• AWS WAF: Add 163.44.193.24/32 to blocked addresses list

---

## Intelligence Notes

The elevated risk score (80/100) combined with DNSBL listings warrants defensive blocking despite the absence of direct threat indicators. The IP's firewalled status with no open services suggests potential use as a relay or command-and-control endpoint. The unstable routing state and basic operator classification indicate limited network reputation.

Monitor for any changes in threat indicators or service openings. Correlate with other signals from RUNSYSTEM-VN network if available.

---

*Report generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.