175.100.10.99📋 Copy

# IP INTELLIGENCE BRIEFING

Target IP: 175.100.10.99/32

Classification: Moderate Risk

Date: 2026-07-22

---

## EXECUTIVE SUMMARY

IP 175.100.10.99 is assigned to Viettel Cambodia (ASN 38623) with a moderate risk score of 40. The IP is associated with residential broadband infrastructure in Phnom Penh, Cambodia, showing no active malicious indicators but exhibiting dynamic IP characteristics typical of ISP customer allocations.

---

## OWNERSHIP & GEOGRAPHY

• ASN: 38623 (IRT-VIETTEL-CAMBODIA-KH)
• Organization: VIETTEL-CAMBODIA
• CIDR Block: 175.100.0.0/20
• Geolocation: Phnom Penh, Cambodia (KH)
• RIR: APNIC
• Service Purpose: Firewalled / No Services Detected

---

## THREAT INDICATORS

• Risk Score: 40/100 (Moderate Risk)
• Blacklist Status: Not listed (0 DNSBL entries)
• Threat Feeds: No active threat indicators
• Tor/VPN/Proxy: Not identified
• Known Attacker: No confirmed malicious activity
• Campaign Correlation: No associated campaigns detected

---

## NETWORK BEHAVIOR

• Open Ports: None detected
• DNS Resolution: dynamic-ip-adsl.metfone.com.kh (reverse DNS confirmed)
• Service Status: No active services responding
• Route Stability: Not route-stable (0 route changes in 30 days)
• BGP Prefix: 175.100.10.0/24

---

## SUBNET ANALYSIS

• Subnet: 175.100.10.0/24
• Abuse Density: 0
• Total Siblings: 3
• Neighbor Risk Distribution:

- 175.100.10.23: Risk Score 55 (Medium Risk)

- 175.100.10.5: No data

- 175.100.10.127: No data

---

## OBSERVATION HISTORY

Fifteen signals observed, most recent from 2026-07-22. Historical data shows:

• Consistent geolocation to Phnom Penh, KH
• No ownership changes recorded
• Threat observation count: 0
• Not persistently malicious

---

## RECOMMENDED ACTIONS

Based on risk profile (40/100), the following controls are recommended:

Firewall Rules:

• iptables: `iptables -A INPUT -s 175.100.10.99 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 175.100.10.99 drop`
• nginx: `deny 175.100.10.99;`

Cloud Platform Blocks:

• Cloudflare WAF: Block IP with description "IPDebrief risk score 40"
• AWS WAF: Add address 175.100.10.99/32 with description "IPDebrief risk 40"

Note: These recommendations are probabilistic and should be combined with other threat signals before implementation.

---

## ASSESSMENT

This IP represents residential ISP infrastructure with no currently observable malicious behavior. The moderate risk score (40) reflects dynamic IP allocation patterns typical of Cambodian broadband providers. While not actively malicious, the IP should be blocked or monitored depending on organizational policy for residential ISP ranges. The subnet exhibits low abuse density, but neighbor 175.100.10.23 shows elevated risk (55) and warrants separate investigation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.