171.231.190.156📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 171.231.190.156/32

Classification: Low Risk / Residential Dynamic IP

Report Date: Current

---

## EXECUTIVE SUMMARY

IP 171.231.190.156 presents a low-risk profile with a reputation score of 25/100. The address is classified as a dynamic residential IP associated with Viettel Vietnam, though geolocation data indicates Chicago, US. The IP has been listed on one of eight DNSBLs with high severity. No active threat indicators or known campaign associations were identified.

---

## PROFILE ANALYSIS

Risk Assessment:

• Overall Risk Score: 25 (Low Risk)
• Reputation: Low Risk
• Provider/Authority Scores: 0 (no provider-specific attribution)
• Stability: Not persistently malicious

Network Classification:

• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• TLS Certificates: None
• CDN/Proxy/VPN/Hosting: False (all classifications negative)

Geolocation Data:

• Reported Location: Chicago, Illinois, US (America/Chicago timezone)
• DNS Resolution: dynamic-ip-adsl.viettel.vn (Vietnam Telecom)
• DNS Consensus: False (geolocation discrepancy noted)
• GeoPlausible: False

Control Plane:

• Origin ASN: 7552
• BGP Prefix: 171.231.184.0/21
• RPKI State: Not validated
• Route Stability: False
• DNSBL Listings: 1 of 8 total lists (1 listed)

---

## OBSERVATION HISTORY

Signal Timeline: 15 total observations

Key Historical Signals:

• DNS Records: Forward resolution to dynamic-ip-adsl.viettel.vn with DNSSEC validation confirmed (2026-07-23)
• Geolocation: Multiple RIR registrations under APNIC, VIETTEL-VN organization with abuse contact hm-changed@vnnic.vn
• Threat Indicators: Listed on 8 DNSBLs with 1 listing showing high severity rating
• Organization Attribution: IRT-VNNIC-AP (Vietnam) with APNIC RIR registration

Temporal Patterns:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 0
• Is Persistently Malicious: False

---

## RELATIONSHIP GRAPH

DNS Associations:

• Primary Hostname: dynamic-ip-adsl.viettel.vn
• Forward Resolution: 1 hostname
• Hosted Domain Count: 0
• Email Auth: SPF and DMARC records present on viettel.vn domain

No additional organizational or certificate relationships detected.

---

## NEIGHBORHOOD ANALYSIS (171.231.190.0/24)

Subnet Overview:

• Total Siblings: 10 IPs in /24
• Abuse Density: 0.1 (low)
• Classification: Mostly Clean
• Inherited Risk: 2

Neighbor Risk Distribution:

• High Risk: 0
• Medium Risk: 2 (171.231.190.94 @ 40, 171.231.190.169 @ 49)
• Low Risk: 7 (including target IP @ 25)

Notable Neighbors:

---

## THREAT INTELLIGENCE ASSESSMENT

Threat Indicators:

• No active threat indicators present
• Not a known attacker
• Not a spam source
• Not a Tor exit node
• No known campaign associations
• Zero pulsedive risk score

Behavioral Analysis:

• Honeypot Hits: 0
• Enumeration Strikes: 0
• WAF Violations: 0
• Traceroute: 22 hops (Comcast, Cogent transit)

---

## RECOMMENDATIONS FOR SOC

Action Priority: LOW

1. Monitoring: No immediate blocking required. Current risk score (25) indicates low threat level.

2. Investigation Triggers: Flag for investigation if:

- Port scan activity detected from this IP

- Connection attempts to sensitive endpoints

- Volume anomalies in traffic patterns

3. Firewall Rules: No specific iptables/nftables rules recommended at this time. Standard perimeter policies apply.

4. DNSBL Verification: One DNSBL listing requires verification. Check which list flags this IP and assess source credibility.

5. Geolocation Discrepancy: Investigate the US vs Vietnam location discrepancy. May indicate:

- Proxy usage

- Spoofed geolocation data

- Multi-hop routing

---

## CONCLUSION

IP 171.231.190.156 is a dynamic residential address with a low-risk profile. The primary concern is the geolocation/location data inconsistency (US vs Vietnam DNS records) and a single DNSBL listing. No active malicious activity or known threat associations were identified. Standard monitoring practices are recommended; no immediate defensive actions are required.

Confidence Level: Medium (based on low-risk score but conflicting geolocation signals)

Next Review: Monitor for risk score changes or new threat indicators

---

*Generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.