27.79.7.163📋 Copy

# IP INTELLIGENCE BRIEFING: 27.79.7.163

## Executive Summary

IP address 27.79.7.163 presents a moderate risk profile (score: 40) associated with Viettel Group infrastructure in Vietnam. The IP is part of the 27.79.0.0/21 BGP prefix originating from ASN 7552 (VIETTEL-AS-AP). No active malicious indicators were identified, but the IP was listed on 2 of 8 DNSBLs and shows minimal operator confidence. SOC teams should monitor for policy violations; current recommendations suggest blocking at perimeter.

---

## Ownership & Network Classification

• Organization: VIETTEL-AS-AP (Viettel Group)
• ASN: 7552
• RIR: APNIC
• Geolocation: Vietnam, Da Nang (16.07°N, 108.22°E)
• Network Role: Provider infrastructure / Firewalled (no services detected)
• BGP Prefix: 27.79.0.0/21
• AS Path: 2914 → 7552

---

## Threat Indicators

• Risk Score: 40 (Moderate Risk)
• Blacklist Status: Listed on 2 DNSBLs
• Operator Score: 0.1304 (Minimal)
• Known Campaigns: None
• Threat Feeds: No matches
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False

---

## Network Environment

The /24 subnet (27.79.7.0/24) contains 11 sibling IPs with 0% abuse density, classified as clean. Risk distribution within the subnet:

• High risk: 0 IPs
• Medium risk: 5 IPs
• Low risk: 6 IPs

Notable neighbors include 27.79.7.22, 27.79.7.61, 27.79.7.100, and 27.79.7.132, all showing similar risk profiles.

---

## Observation History

IPDebrief recorded 24 observations over the monitoring period. The most recent observation (2026-06-25) confirmed:

• Minimal operator score (0)
• Stable routing attributes
• Consistent geolocation data
• No emergence of new threat indicators

Historical data indicates consistent behavior with no escalation in risk profile.

---

## Technical Characteristics

• Open Ports: None detected
• DNS Resolution: Forward resolution to "localhost" only
• Reverse DNS: localhost
• TLS/HTTP Services: None detected
• WAF Violations: 0
• Honeypot Hits: 0

---

## Recommended Actions

Based on the risk profile, the following firewall rules are recommended:

---

## Intelligence Assessment

The IP represents legitimate Viettel Group infrastructure with moderate risk due to DNSBL listings and operator classification. The subnet environment is clean with no evidence of coordinated malicious activity. However, the presence on DNSBLs warrants continued monitoring and consideration of blocking at the network perimeter. No immediate threat action required beyond standard filtering.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.