171.231.199.119📋 Copy

# IP Intelligence Briefing: 171.231.199.119/32

Classification: Moderate Risk (49/100) | Status: Active Threat Indicator

## Executive Summary

IP address 171.231.199.119 is a Viettel Group infrastructure endpoint located in Da Nang, Vietnam, classified as a known attacker with active threat indicators. The IP demonstrates persistent malicious activity characteristics with blacklist listings and suspicious behavior patterns.

## Ownership and Network Context

• Organization: IRT-VNNIC-AP (Viettel Group)
• ASN: 7552
• CIDR Block: 171.231.192.0/21
• Location: Da Nang, Vietnam (14.06°N, 108.28°E)
• Geolocation Confidence: Plausible (multi-source consensus)
• Network Classification: Firewalled/No Services Detected

## Threat Indicators

• Known Attacker: Yes
• Blacklist Count: 1
• Threat Feeds: Emerging Threats
• Abuse Confidence: Evident from multiple signal sources
• Persistence: No persistent malicious pattern detected, but recent activity confirmed

## Neighborhood Analysis (171.231.199.0/24)

• Subnet Abuse Density: 0.5 (50%)
• Threat Siblings: 4 of 8 active endpoints
• Risk Distribution: 3 medium-risk, 7 low-risk neighbors
• Notable Risky Neighbors: 171.231.199.134 (49), 171.231.199.211 (40), 171.231.199.252 (40)

## Historical Observations

• Total Observations: 24
• Recent Activity: Confirmed through June 2026
• Geolocation Consistency: Vietnam (Da Nang) consistently reported
• ASN Consistency: Viettel Group (7552) across all observations
• Temporal Pattern: Single threat observation event, not persistently malicious

## Recommended Actions

Immediate (High Severity)

```bash

# iptables

iptables -A INPUT -s 171.231.199.119 -j DROP

# nftables

nft add rule inet filter input ip saddr 171.231.199.119 drop

# pfSense

171.231.199.119/32 (add to block list)

```

Application Layer

```nginx

# nginx

deny 171.231.199.119;

# Cloudflare WAF

Block 171.231.199.119 — IPDebrief risk score 49

# AWS WAF

Addresses: ["171.231.199.119/32"]

```

## Intelligence Notes

1. Subnet Context: The /24 subnet shows elevated abuse density (50%). Consider reviewing neighboring IPs 171.231.199.134, 171.231.199.211, and 171.231.199.252 for similar threat characteristics.

2. Provider Attribution: Traffic originates from Viettel Group, a major Vietnamese telecommunications provider. This infrastructure may be legitimately used for various purposes, but the specific endpoint shows malicious indicators.

3. DNS Resolution: PTR record indicates dynamic ADSL endpoint (dynamic-ip-adsl.viettel.vn), suggesting residential or SME connectivity rather than enterprise infrastructure.

4. Operational Guidance: Block at network edge with rate-limiting as secondary measure. Monitor for any changes in geolocation or ASN attribution which could indicate infrastructure migration.

---

Report Generated: 2026 | Data Sources: IPDebrief Intelligence Platform | Classification: SOC Actionable Intelligence

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.