171.225.195.113📋 Copy

# IP Intelligence Briefing: 171.225.195.113

Classification: Residential Broadband / Dynamic IP

Risk Assessment: Low (Score: 25/100)

Date of Analysis: 2026-07-24

---

## EXECUTIVE SUMMARY

IP 171.225.195.113 is a dynamic residential broadband address assigned to Viettel's Vietnamese ISP infrastructure. While the IP maintains a low overall risk profile (25), it exhibits notable threat indicators including DNSBL listings and historical threat signal correlation. No active services or open ports were detected. The subnet shows zero abuse density, indicating isolated behavior rather than coordinated activity.

---

## OWNERSHIP & INFRASTRUCTURE

The IP is part of Vietnam's state-owned telecommunications provider Viettel, utilizing a large /11 address block for residential broadband services.

---

## THREAT INDICATORS

• DNSBL Listings: 1/8 total listings detected
• DNSBL Severity: High (maximum severity rating observed)
• Threat Signals: Historical signals indicate threat correlation (Pulsedive risk signals present)
• Blacklist Count: 0 active threat feeds
• Abuse Confidence Score: Not applicable (residential IP)

Key Finding: The IP appears on at least one DNSBL with high severity classification, suggesting prior abuse activity. However, current risk assessment remains low (25).

---

## NETWORK BEHAVIOR

• Open Ports: None detected
• Services: Firewalled / No Services
• TLS Certificate: None
• DNS PTR: dynamic-adsl.viettel.vn
• Forward Resolution: Confirmed (viettel.vn)
• Email Auth: SPF and DMARC records present

No active services were detected on this IP. The PTR hostname indicates dynamic residential assignment.

---

## OBSERVATION HISTORY (16 Signals)

Recent observations reveal:

• 2026-07-24 09:17:39 - AlienVault OTX signal: Threat indicators present (reputation: 0, pulse count: 1)
• 2026-07-24 09:17:32 - DNSBL listing observed (8 total lists, 1 listed, max severity: high)
• 2026-07-24 09:18:22 - Ownership signals confirmed (IRT-VNNIC-AP, VIETTEL-VN)

Temporal Analysis: Ownership stability observed with no recent changes. Threat persistence days: 0.

---

## NETWORK RELATIONSHIPS

• Network Association: VIETTEL-VN (171.225.195.0/24)
• DNS Associations: dynamic-adsl.viettel.vn (duplicate association)
• Related Entities: 3 total relationships

---

## SUBNET ANALYSIS (171.225.195.0/24)

The subnet shows zero abuse density, confirming this IP operates in isolation without correlation to other abusive addresses.

---

## TRACEROUTE ANALYSIS

• Hop Count: 28
• Transit Networks: Comcast, NTT
• RTT Analysis: First hop 0.2ms, last hop 255.1ms
• Timed Out Hops: 17
• Route Stability: Unstable (route changes: 0 in 30d)

---

## ACTIONABLE RECOMMENDATIONS

SOC Analyst Actions:

1. Monitor DNSBL Activity: Verify legitimacy of the high-severity listing. Investigate what specific blacklist(s) are listed.

2. False Positive Assessment: Given low risk score (25) and clean subnet, assess whether DNSBL listing is a false positive or legitimate abuse signal.

3. Traffic Correlation: If this IP appears in threat intelligence feeds, cross-reference with known Vietnamese threat actor infrastructure.

4. Block Decision: Low priority for blocking unless DNSBL listing is verified as credible threat indicator. Consider allow with logging for traffic analysis.

5. Residential Context: Recognize as residential broadband; false positives are common for dynamic residential IPs.

Firewall Rules: No specific blocking rules recommended. Monitor but allow with logging.

---

Analyst Notes: This IP represents typical Vietnamese residential broadband. The DNSBL listing warrants investigation but does not indicate immediate threat. Subnet cleanliness and low risk score suggest isolated behavior rather than coordinated malicious activity.

Intel Confidence: Medium (DNSBL severity conflict with low risk score)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.