171.231.193.87📋 Copy

# IP INTELLIGENCE BRIEFING: 171.231.193.87/32

Date: 2026-07-28

Classification: Moderate Risk

Risk Score: 40/100

## Executive Summary

IP address 171.231.193.87 is a firewalled infrastructure address within the Viettel-VN network block (171.224.0.0/11), operated by ASN 7552 (IRT-VNNIC-AP). The IP presents moderate risk with significant geolocation inconsistencies and no active threat indicators. Defensive firewall rules are recommended.

## Network Ownership & Classification

• Organization: IRT-VNNIC-AP (Viettel Group)
• Network Name: VIETTEL-VN
• CIDR Block: 171.224.0.0/11 (APNIC RIR)
• ASN: 7552
• Network Type: Provider infrastructure
• Service Status: Firewalled / No services detected

## Geolocation Analysis

Critical inconsistency detected in geolocation data:

• Primary profile indicates US/Chicago (US-IL)
• Historical observations show Vietnam (Ha Noi City, Tran Huu Duc street)
• Geo-plausible validation shows 9,358.7 km distance discrepancy
• ICMP validation blocked; unable to confirm physical location

This discrepancy suggests either misconfigured routing, spoofed geolocation data, or multi-region hosting infrastructure.

## Threat Indicators

• Abuse Confidence: No active threat indicators
• Known Attacker: No
• Spam Source: No
• Tor Exit: No
• Blacklist Status: 0 blacklists, 2 DNSBL listings out of 8 total
• Threat Persistence: No persistent malicious activity detected

## DNS & Network Intelligence

• PTR Record: dynamic-ip-adsl.viettel.vn
• Forward Resolution: dynamic-ip-adsl.viettel.vn
• Email Authentication: SPF record present, DMARC configured
• Control Plane: BGP origin 171.231.192.0/21, stable routing
• DNSSEC: Valid

## Neighborhood Analysis

Subnet 171.231.193.0/24 contains 13 neighboring IPs:

• Risk Distribution: 10 low-risk, 3 medium-risk, 0 high-risk
• Abuse Density: 0 (subtly low threat concentration)
• Notable Neighbors:

- 171.231.193.204 (Risk: 55)

- 171.231.193.153 (Risk: 40)

- 171.231.193.85 (Risk: 50)

## Historical Observations

16 signal observations recorded. Notable trends:

• Recent ownership signals from Vietnam (2026-07-28)
• Geolocation signals show country code inconsistencies (VN/US)
• Provider RIR registration (APNIC) confirmed across observations
• No sustained malicious activity patterns detected

## Recommended Security Actions

Based on risk profile, the following firewall rules are recommended:

iptables:

```

iptables -A INPUT -s 171.231.193.87 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 171.231.193.87 drop

```

Cloudflare WAF:

```json

{

"description": "Block 171.231.193.87 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 171.231.193.87"

}

}

```

AWS WAF:

```json

{

"Addresses": ["171.231.193.87/32"],

"Description": "IPDebrief risk 40"

}

```

## Intelligence Assessment

The IP address represents Viettel infrastructure with moderate risk classification. Key concerns include geolocation data inconsistencies that warrant monitoring. No active exploitation attempts detected. The IP is firewalled with no open services, reducing immediate attack surface. Monitor for geolocation pattern changes or emergence of threat indicators in the /24 subnet.

Recommendation: Implement blocking rules with awareness of legitimate business use cases (Viettel is a major Vietnamese telecommunications provider). Monitor the subnet for activity patterns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.