171.225.203.186📋 Copy

# IP Intelligence Briefing: 171.225.203.186/32

Date: 2026-07-29 | Classification: High Risk | Risk Score: 70/100

## Executive Summary

IP address 171.225.203.186 is a dynamic residential endpoint associated with Viettel Vietnam (ASN 7552, IRT-VNNIC-AP). The IP is registered within the 171.224.0.0/11 block and geolocated to Haiphong, Vietnam. Despite elevated risk scoring, no active threat indicators were detected during profiling. Recommended action: Block at perimeter with logging enabled for anomaly correlation.

---

## Ownership & Network Profile

• Organization: IRT-VNNIC-AP (Viettel)
• ASN: 7552
• Network Block: 171.224.0.0/11
• CIDR: 171.225.203.0/24
• Geolocation: Haiphong, Vietnam (VN)
• RIR: APNIC
• PTR Record: dynamic-ip-adsl.viettel.vn

---

## Threat Assessment

Analysis: The elevated risk score (70/100) is primarily driven by DNSBL presence and network classification. No active malicious indicators were identified in threat feeds or behavioral analysis. The IP is not associated with known campaigns or persistent attacker behavior.

---

## Network Neighborhood

The /24 subnet (171.225.203.0/24) shows minimal abuse density (0.0). Two sibling IPs observed:

• 171.225.203.168: Risk 40/100, Authority 50
• 171.225.203.190: Risk 25/100, Authority 50

No significant threat clustering detected within the subnet.

---

## Historical Observations

Sixteen signals observed over the monitoring period. Recent observations indicate:

• No ownership changes
• Minimal threat persistence
• Stable geolocation (Vietnam)
• Forward DNS resolution confirmed

---

## Recommended Actions

Immediate Mitigation

Block this IP at perimeter defenses using the following rules:

iptables:

```bash

iptables -A INPUT -s 171.225.203.186 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 171.225.203.186 drop

```

Cloudflare WAF:

```json

{"description":"Block 171.225.203.186 — IPDebrief risk score 70","action":"block","filter":{"expression":"ip.src eq 171.225.203.186"}}

```

Enhanced Monitoring

1. Increase logging verbosity for traffic from this subnet

2. Monitor for port scanning activity from related addresses (171.225.203.168, 171.225.203.190)

3. Correlate with DNSBL reputation feeds for additional context

---

## Intelligence Notes

This IP represents a Viettel residential endpoint with elevated risk scoring due to DNSBL presence. The lack of open services and no active threat indicators suggests this may be a flagged residential IP rather than an active threat source. However, the 4/8 DNSBL listings warrant blocking at the network perimeter. SOC teams should monitor for any behavioral changes and update threat intel feeds accordingly.

---

*Generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.