27.79.1.91📋 Copy

# IP INTELLIGENCE BRIEFING: 27.79.1.91/32

## Executive Summary

IP 27.79.1.91 presents a low-risk profile with no active threat indicators. The address belongs to BGP prefix 27.79.0.0/21 (ASN 7552) with minimal operator impact. No active services, open ports, or malicious behavior observed. No security actions recommended at this time.

---

## Profile Overview

---

## Geolocation & Network Attribution

• Primary Location: US, Illinois, Chicago
• BGP Prefix: 27.79.0.0/21
• Origin ASN: 7552 (Viettel Group, VN)
• RIR Registry: APNIC (allocated 2010-04-27)
• Country Code Discrepancy: RIR records indicate Vietnam (VN), while geolocation data shows US
• Route Stability: Unstable (isRouteStable: false)
• Route Changes (30d): 0

---

## Threat Indicators

• Blacklist Count: 0
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Threat Feeds: None populated
• Pulsedive Risk: Not applicable
• Campaign Matches: 0

---

## DNS Analysis

• PTR Hostname: localhost
• Forward Resolution: localhost (not confirmed)
• Reverse DNS Confirmed: No
• Hosted Domains: None
• Email Auth (SPF/DMARC): Not configured
• DNSSEC: Valid
• Forward Resolution Count: 1

---

## Services & Behavioral Analysis

• HTTP/HTTPS: No services detected
• TLS Certificate: None
• Banner/Title: None captured
• Honeypot Hits: 0
• Enumeration Strikes: 0
• WAF Violations: 0
• Auto-Banned: No
• Active Attacker Status: No

---

## Observation History (17 total signals)

Recent activity observed through 2026-07-29:

• Operator Score: 0.1304 (Minimal)
• DNSSEC Validation: Confirmed
• ASN Attribution: Consistent (7552)
• Signal Confidence: Variable (0.16-0.90)
• Threat Persistence: 0 days
• Ownership Changes: 0

No escalation in threat posture over observed period.

---

## Network Neighborhood (27.79.1.0/24)

Notable Sibling Risk Scores:

• 27.79.1.152: 65
• 27.79.1.172: 55
• 27.79.1.14/15/26/69/70/84/85/87/107/116/226/245: 15-40 range

---

## Traceroute Analysis

• Hop Count: 21
• First Hop RTT: 0.1ms
• Last Hop RTT: 245.9ms
• Timed Out Hops: 6
• Transit Networks: Comcast, Cogent

---

## Recommended Security Actions

No actionable firewall rules or blocking recommendations at this time. The IP presents minimal risk with no active threat indicators, no open services, and no evidence of malicious behavior.

Monitoring Recommendations:

• Continue passive observation of subnet 27.79.1.0/24
• Monitor for service activation on target IP
• Watch for changes in reverse DNS or email authentication records

---

## Intelligence Assessment

IP 27.79.1.91 is classified as a firewalled address with no active services. The low-risk score (0) combined with zero blacklist listings and absence of threat indicators indicates benign operation. Geographic discrepancies between RIR records (Vietnam) and geolocation data (US) warrant periodic verification but do not indicate malicious activity. The subnet exhibits mixed risk profiles with 10 medium-risk siblings, suggesting potential shared infrastructure usage but no direct correlation to the target IP.

Confidence Level: High

Recommended Action: Monitor / No Action Required

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.