27.74.154.9📋 Copy

## IP Intelligence Briefing: 27.74.154.9

Classification: Moderate Risk | Risk Score: 40/100

Executive Summary

IP address 27.74.154.9 presents as a low-to-moderate risk infrastructure address with no active threat indicators. The IP is associated with Viettel-VN network infrastructure under ASN 7552 (IRT-VNNIC-AP). No malicious campaigns, known attacker signatures, or active threat feeds correlate with this address.

Network Ownership & Geolocation

• ASN: 7552 (IRT-VNNIC-AP, Viettel-VN)
• CIDR Block: 27.64.0.0/12
• RIR: APNIC
• Geolocation Discrepancy: Multiple geo sources report conflicting data—some indicate United States, others Vietnam. This inconsistency warrants monitoring but does not indicate active compromise.

Threat Indicators

• Blacklist Status: Listed on 2 of 8 DNS blacklists (25% contamination rate)
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Threat Feeds: None detected
• Abuse Confidence: Not applicable (null data)

Network Role & Services

• Infrastructure Classification: Provider network with firewalled/no services detected
• Open Ports: None detected
• DNS Resolution: localhost only (forward confirmed: false)
• Email Auth: No SPF or DMARC records
• Control Plane: DNSSEC valid, BGP prefix 27.74.152.0/21, RPKI state: null

Neighborhood Analysis

• Subnet: 27.74.154.0/24
• Abuse Density: 0%
• Threat Siblings: 0 of 1 total sibling IPs
• Classification: Clean subnet

Historical Activity (16 Observations)

• Recent Trend: Consistent clean classification
• Ownership Stability: No ownership changes recorded
• Threat Persistence: No persistent malicious activity detected
• Most Recent Signal (2026-07-24): Clean subnet classification with 0.40 confidence

Related Entities

• Primary Network Association: VIETTEL-VN (3 relationship entries)
• DNS Associations: localhost (5 relationship entries)
• Certificate Associations: None

Recommended Actions

• Firewall Policy: Monitor but no immediate blocking required
• Threat Hunting: No immediate investigation required
• Geo-IP Validation: Verify geolocation discrepancy during routine monitoring

SOC Analyst Notes

This IP represents legitimate network infrastructure with no evidence of malicious activity. The moderate risk score (40/100) is primarily driven by DNS blacklist contamination rather than active threat indicators. The geolocation inconsistency between US and Vietnam sources should be noted for potential BGP route hijacking analysis, but current data does not support malicious intent. Continue standard monitoring procedures.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.