171.231.183.94📋 Copy

IP INTELLIGENCE BRIEFING: 171.231.183.94/32

EXECUTIVE SUMMARY

IP 171.231.183.94 is classified as a Vietnamese residential ISP address belonging to Viettel Vietnam (ASN 7552) with a moderate overall risk score of 50. The address operates as a dynamic ADSL connection with no open services detected. Neighborhood analysis indicates low-to-moderate risk concentration within the /24 subnet.

OWNERSHIP & CLASSIFICATION

• Organization: IRT-VNNIC-AP / Viettel Vietnam (VIETTEL-VN)
• ASN: 7552
• CIDR Block: 171.224.0.0/11
• RIR: APNIC
• Network Role: Residential ISP / Dynamic ADSL
• Classification: Firewalled / No Services

GEOLOCATION

• Country: Vietnam (VN)
• Region/City: Da Nang
• Coordinates: 14.06°N, 108.28°E
• Accuracy: 600km radius
• Timezone: Asia/Ho_Chi_Minh

THREAT ASSESSMENT

• Overall Risk Score: 50 (Moderate Risk)
• Abuse Confidence Score: Not assessed
• Blacklist Status: Listed on 2 of 8 DNS blacklists (high severity listing present)
• Threat Indicators: None detected
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Persistence: Not persistently malicious (0 threat observation days)

NETWORK BEHAVIOR

• Service Status: No open ports detected
• DNS: Resolves to dynamic-ip-adsl.viettel.vn (dynamic residential hostname)
• Email Reputation: SPF and DMARC records present for viettel.vn
• Control Plane: BGP origin 171.231.176.0/21; route stability flagged as false
• Traceroute: 23 hops via Comcast and Cogent transit networks

NEIGHBORHOOD ANALYSIS (171.231.183.0/24)

• Subnet Abuse Density: 9.09%
• Classification: Mostly clean
• Total Siblings: 11 IPs
• Active Siblings: 5
• Risk Distribution: 0 high risk, 2 medium risk, 8 low risk
• Notable Neighbor: 171.231.183.42 (risk score 55)

OBSERVATION HISTORY

• Total Signals: 17 observations
• Recent Activity: Multiple signals from July 2026 including geolocation, subnet analysis, operator scoring, and blacklist listings
• DNS Blacklist Activity: IP listed on 2 of 8 monitoring lists with maximum severity rating of "high"

RECOMMENDED ACTIONS

The following firewall rules are recommended based on risk profile:

iptables:

```

iptables -A INPUT -s 171.231.183.94 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 171.231.183.94 drop

```

Cloudflare WAF:

```

{"description":"Block 171.231.183.94 — IPDebrief risk score 50","action":"block","filter":{"expression":"ip.src eq 171.231.183.94"}}

```

AWS WAF:

```

{"Addresses":["171.231.183.94/32"],"Description":"IPDebrief risk 50"}

```

SOC ANALYST NOTES

This IP represents a dynamic residential connection from a legitimate Vietnamese ISP. While the risk score is moderate (50), the absence of open services, no known attacker status, and the ISP's legitimate nature suggest this may be a false positive or incidental listing. The neighborhood shows low threat concentration (1 of 11 siblings flagged as threat). Consider context-aware blocking rather than blanket denial, and monitor the IP for actual malicious activity before implementing permanent restrictions.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.