The 2Gbps Number Has Three Meanings: Testing GoFiber’s Small-Cloud Bargain

Summary

• GOFIBER SOFTWARE TECHNOLOGY COMPANY LIMITED can be linked togofiber.vnvia the site's legal footer, the Vietnamese tax directory records, and the APNIC registration for AS149147. It is not the similarly-named European company GoFiber Ltd, associated with AS211041.
• GoFiber's offering is best understood as a local integration layer: it combines web design, migration, shared hosting, KVM VPS, dedicated servers, and colocation marketing, billing in Vietnamese dong and human support. This combination can be more valuable for a small organization than any raw compute specification.
• AS149147 is a significant piece of technical evidence. Public routing data shows an active origin, multiple IPv4 and IPv6 prefixes, a valid route origin authorization for observed IPv4 announcements, and a directly visible relationship with Viettel-CHT. This does not prove physical server ownership, traffic volume, rack capacity, facility location, customer count, or end-to-end redundancy.
• GoFiber's current public pages leave material procurement questions open. ‘2Gbps’ is used for international capacity and DDoS language while individual products advertise different port speeds; availability appears as both 99% and 99.9%; trial periods appear as both 24 hours and five days; and one VPS price differs between pages. A buyer needs the signed order and service schedule, not the marketing page, to establish the real commitment.
• The smallest plans can be economically attractive, especially when local support, migration, and payment are important. The trade-off is fewer public details on contention, backup, service credits, incident handling, subcontractors, data egress, and control plane capabilities than what buyers can get from large clouds. A small benchmark, an exit exercise, and precise contractual questions are therefore part of the product evaluation, not optional due diligence.

One Number, Three Control Surfaces

The most revealing number on GoFiber's website is 2Gbps. In a May 2025 announcement, the company said it completed an upgrade to2Gbps of international bandwidth, describing the change as a tenfold increase and presenting it as protection against slow international access and submarine cable disruptions. The shared hosting comparator uses a similar number for‘2Gbit/s DDoS Protection’. Yet the VPS catalogue specifies200Mbps for each listed plan, while two dedicated server examples specify 1Gbps domestic connectivity and100Mbps international connectivity.

These figures are not necessarily contradictory, as they may describe different layers. A provider can have a shared international transit commitment, apply a per-VM port limit, sell different throughput with a physical server, and advertise an attack mitigation threshold. But the layers are not interchangeable. A 200Mbps virtual interface says nothing in itself about sustained international throughput at 9pm. A 2Gbps aggregated international link says nothing about how many customers share it, whether it is committed or burst, whether the return path is equivalent, or what happens when a customer is under attack.

A 2Gbit/s DDoS statement is not a security architecture unless it defines where scrubbing occurs, which attack classes are covered, whether the number is aggregate or per-customer, and what happens above the threshold.

This distinction is at the core of GoFiber's procurement problem. The company sells a broad, accessible cloud offering in plain language. The customer, however, consumes a chain: application, operating system, hypervisor, storage, rack, power, cooling, domestic network, international transit, DNS, support, and billing. The public pages disclose some specifications of this chain but not the full dependency map.

The correct reading is neither ‘the numbers are wrong’ nor ‘the plan includes everything the number seems to promise’. The verified fact is that GoFiber publishes these numbers. The company’s claim is that the international upgrade and defensive controls improve service. The reasonable inference is that a common network platform underpins multiple product families. The open questions concern allocation, contention, measurement, failover, and remedies. These questions determine whether a low labelled price represents efficient local infrastructure or simply transfers operational uncertainty to the buyer.

The company behindgofiber.vn

Identity matters especially in hosting because the name on the invoice, the operator of an IP network, and the party holding customer data can be different. GoFiber's footer identifies the operator asCông ty TNHH Công Nghệ Phần Mềm Gofiber, gives the business registration number0317495104, states that registration was issued on 29 August 2022, and lists231 Tây Thạnh, phường Tây Thạnh, quận Tân Phú, Thành phố Hồ Chí Minhas the address. The samehomepagepublishes separate business and technical contact details.

A Vietnamese tax information directory independently listsCông ty TNHH Công Nghệ Phần Mềm GoFiber, the same tax number and address. It identifies the English name as GOFIBER SOFTWARE TECHNOLOGY COMPANY LIMITED, records computer programming as the main activity, and gives 28 September 2022 as the operating date. The August and September dates appear to describe different administrative steps; they should not be merged into a single incorporation date without the underlying register document. The tax site is a secondary directory rather than the official certificate, so a material contract should still request a current extract from the business register and verify the billing bank account against the legal entity.

Network evidence reinforces the link. The derived APNIC record shown byBGP.tools for AS149147names GOFIBER SOFTWARE TECHNOLOGY COMPANY LIMITED, uses the handleGOFIBER-SOFTWARE-VN, gives the same 231 Tây Thạnh address, and shows maintenance via VNNIC. A matching legal name, domain, address, and network record form a much stronger identity chain than a logo or search result alone.

It is also important to clarify what this article is not. A separate UK entity,GOFIBER LTD, company number 15796689, was incorporated in 2024 and later dissolved. APeeringDB entry for GoFiber Ltdassociates that name with AS211041 and a European network presence. That company, that ASN, and that operational history are distinct from the Vietnamese company examined here. A similar name must not be used to transfer customers, incidents, credentials, or corporate facts from one entity to another.

The exact boundary is therefore narrow and verifiable: the subject is the Vietnamese limited liability company with registration number 0317495104, operatinggofiber.vnand registered under AS149147. Claims of an upstream carrier, a data centre operator, an international cloud brand, or an unrelated GoFiber are not automatically claims about this company.

A web studio moving down the stack

GoFiber does not present itself as merely an infrastructure seller. Itspublic sitehighlights website design, software development, search optimisation, and ongoing maintenance, then extends to shared hosting, VPS, and physical server services. This changes the nature of the offering. A small retailer or professional office may not be buying an isolated virtual CPU. It may be buying a single, accountable Vietnamese provider to build a site, move its data, host it, renew its domain or certificate, investigate an error, and issue a local invoice.

This bundling can solve a real coordination problem. With a globally self-service cloud, a client may hire a developer, a system administrator, a security provider, and a hosting platform separately. When the site slows, each party can point to another layer. GoFiber's model potentially eliminates those handoffs. Theservice registration guidedescribes an online ordering flow, selectable billing periods, payment before credential delivery, and email notification of service information. The homepage states the company will migrate a website from another provider at no charge when the client opens a support ticket and will test it before handover.

This integration is probably GoFiber's most defensible form of local cloud substitution. It is not a substitution in the hyperscale sense of matching hundreds of managed services, global regions, or programmable infrastructure. It is a substitution at the level of customer labour: ‘make this business website or application work, let me pay in dong and give me someone to contact.’ For that buyer, the support labour, migration knowledge, and concentration of responsibility may outweigh a longer feature list.

The same breadth creates ambiguity about the operational boundary. Shared hosting typically leaves the provider responsible for more of the software stack. A KVM virtual server with full root access shifts operating system patching, firewall configuration, application security, and backups to the client. GoFiber explicitly states on itsVPS pagethat customers receive full administrative control and can install and manage software without technical intervention. A dedicated machine moves even more application responsibility to the client while leaving hardware replacement, setups, and network obligations with the provider or its own suppliers.

A buyer should therefore reject a single blanket phrase such as ‘24/7 technical support’ for all products. The order should specify, per product, who fixes host and guest, who monitors storage, who restores data, who responds to malware, who replaces a failing disk, who holds software licences, and which work is billable. Without this matrix, the integrated sales proposition can fracture at failure time.

GoFiber's customer evidence is still thin in public. The homepage carries short testimonials and general statements about transferred sites, but it does not publish a technically detailed case study showing an architecture, baseline, migration method, measured outcome, and named customer endorsement. That does not mean the company lacks satisfied customers. It means the public proof cannot yet distinguish a good support experience on a small website from sustained operation of a latency-sensitive or business-critical workload.

The VPS scale hides its denominators

GoFiber's VPS catalogue is easy to understand at first glance. The entry-level plan advertises one core, 2 GB of memory, 30 GB of NVMe storage, and 200Mbps for 140,000 VND per month before 10% VAT. The list rises through ten plans to 32 cores, 64 GB, 300 GB, and the same nominal 200Mbps. Three-month, six-month, and twelve-month commitments receive advertised discounts of 5%, 10%, and 15%. Add-on options are listed at 50,000 VND per CPU core, 50,000 VND per GB of RAM, 40,000 VND per 10 GB of NVMe storage, and 100,000 VND per additional IP address.

The prices are concrete; the resource semantics are not. ‘Core’ could mean a vCPU thread, a proportional share, a burst allocation, or a dedicated physical core. The page says KVM, which establishes the claimed virtualisation family, but KVM alone does not define CPU over-commitment, host generation, NUMA layout, storage replication, IOPS, snapshot behaviour, or noisy-neighbour controls. ‘NVMe’ also does not reveal whether the storage is local to a node, mirrored across devices, replicated to another host, or backed up in a separate failure domain.

The plan sequence itself rewards workload-based testing rather than tier-picking. One plan offers four cores and 16 GB for 990,000 VND; the next offers eight cores and 8 GB for 1.29 million VND. This may be reasonable for CPU-bound versus memory-bound work, but it means ‘higher plan’ is not a linear upgrade. The client must know whether their bottleneck is CPU time, memory pressure, storage latency, network throughput, or administrative support.

IPv4 pricing is another clue to the company’s economics. An additional address at 100,000 VND per month costs about 71% of the 140,000 VND VPS entry price. That does not make the fee unreasonable: globally scarce IPv4 space has an economic cost, and reputation management adds operational work. It does mean that workloads requiring multiple addresses may feel very different from the starting price.

A buyer should ask whether IPv6 is included, whether reverse DNS is delegated or managed by ticket, whether an address can be replaced if it carries a poor reputation, and what happens to address assignments when a server is resized or migrated.

The public catalogue also contains a price-control warning. At the time of access, the detailed VPS page listed its 16-core, 32 GB, 300 GB plan at 2.09 million VND per month, while a plan display on the homepage showed 3.09 million VND for what appeared to be the same specification. The discrepancy may be a stale card or a different offer, but the customer cannot resolve it from the two pages. The signed quote must identify the plan, resources, tax, renewal price, and validity period.

Prepayment discounts create a second economic layer. Paying twelve months at 15% below the monthly list price reduces cash outlay but increases exposure to service quality and egress friction. The rational least-cost contract is not automatically the longest one. A buyer should use the shortest period that covers a representative load cycle, perform an exit test, and then decide whether the annual discount compensates for the concentration risk.

GoFiber states that upgrades can be made at any time, with the system calculating the difference and applying the new price at the next renewal. That is useful, but it leaves several cases to clarify: whether an in-cycle upgrade is prorated immediately, whether downgrades wait for renewal, whether changing CPU or RAM requires a reboot, whether storage can ever be reduced, and whether an IP or backup option follows the same term. The physical server page separately states that an upgrade typically causes 10-15 minutes of downtime.

That is a company estimate, not a guaranteed maintenance window, and the order should state whether it applies to memory, storage, CPU, chassis migration, or all.

The 400-account clue from shared hosting

The shared hosting table discloses one of the most useful numbers on the site:400 accounts per serveracross the displayed plans. This does not reveal actual occupancy or performance, but it gives buyers a more concrete question than the word ‘cloud’. What are the host specifications, how is admission controlled, and what happens when the resource demand of 400 authorised accounts peaks simultaneously?

Plans start at 49,000 VND per month for 1 GB of storage, 1 GB of RAM, a ‘Full CPU’ and one domain. Higher tiers increase storage, domains, memory, and CPU; two plans advertise ‘Unlimited’ storage. The comparator also lists inode limits of 150,000, 250,000 or 500,000 and a limit of 25 concurrent MySQL connections. These finite controls show why ‘unlimited’ should be read as ‘not billed by a stated disk quota, subject to other resource and acceptable-use limits’, not as infinite capacity.

GoFiber advertises CloudLinux isolation, Imunify360 malware scanning, SSL, and 2Gbit/s DDoS protection. These are plausible components of a shared hosting stack, and CloudLinux-style account controls can reduce one tenant’s ability to monopolise a machine. But product names do not disclose configuration. Buyers still need the per-account CPU time policy, I/O and IOPS limits, entry process limit, scanning and remediation workflow, backup frequency, retention, restoration fee, and the provider’s response when an account is compromised.

The page is inconsistent on availability. The introductory text says availability can reach 99%, while the comparison table indicates a 99.9% SLA. Over a 30.4-day month, 99% allows about 7.3 hours of downtime; 99.9% allows about 43.8 minutes. This tenfold difference is commercially significant. Neither number is meaningful unless the contract defines the measurement point, excluded maintenances, incident start and end, claims procedure, and service credit.

Several support lines in the detailed table also appear as dashes, including troubleshooting or post-compromise work, even though the wider site promises 24/7 support. This may simply distinguish platform support from client application repair. It nevertheless reinforces the need for a responsibility schedule. An account at 49,000 VND cannot economically include unlimited senior engineering work; the enduring question is which support is included, which is best-effort, and which is a paid service.

What AS149147 really proves

The strongest independent evidence for GoFiber's infrastructure role is AS149147. An autonomous system is a network that presents a routing policy to the internet. Having one does not make a company a data centre owner, but it is materially different from selling web space without any visible network identity.

As observed on 16 July 2026,BGP.toolsshowed AS149147 as an active APNIC allocation with eleven IPv4 prefixes and two IPv6 prefixes in the displayed routing set. The eleven IPv4 announcements were /23s, i.e. twenty-two /24 blocks, and the interface marked observed IPv4 routes as RPKI valid. RPKI validity means the observed originating ASN was authorised by a route origin authorisation for those prefixes. This reduces one class of accidental or malicious route origin error; it does not authenticate customer traffic, secure servers, or guarantee route availability.

The routing record is also revealing because the descriptions attached to the originated prefixes do not all carry GoFiber's name. They include blocks whose registry descriptions name DTT Saigon, BTT, Tekaway, Green Light, Tuan Tu, Dgon, VNG Cloud, and other Vietnamese organisations. The verified observation is that AS149147 originated these prefixes and that registry descriptions associated the address blocks with those names. It would be dangerous to call every named organisation a customer, subsidiary, or partner.

The arrangement could reflect transit, sponsored BGP, leased address space, network operations, historical registration, or another contractual structure not visible in BGP.

This is precisely where public network resource evidence is useful. It can falsify an overly simple story. GoFiber is not announcing only a small block carrying its own label; its routing surface extends across multiple registered descriptions. This suggests a role in operating or presenting third-party address space to the internet. But BGP cannot disclose the commercial agreement, the physical location of machines using those addresses, the traffic volume, the service level, or who controls the end systems.

The IPinfo profile of AS149147classified it as a hosting network, described it as a stub ASN, estimated hundreds of hosted domains, and counted a larger IPv4 footprint than the contemporaneous BGP.tools route display. These figures are third-party estimates built from IP and domain observations, not audited customer records. The difference between databases is itself instructive: route visibility, historical ranges, classification methods, and exploration timing vary. ‘Hosted domains’ must never be read as ‘paying customers’, and the address count must not be read as server capacity.

Cloudflare Radar's routing view for AS149147provides another independent observation surface for announcements and route validity. It is useful for verifying changes over time, especially withdrawals or invalid origins. It still sees the system from the outside. It cannot show a failing disk, an overloaded hypervisor, a private interconnection, a backup job, or the response time of GoFiber's support desk.

The procurement value of the ASN is therefore specific. A buyer can ask GoFiber which prefix will serve the workload, whether the route has a valid ROA, which upstream carriers carry it, whether IPv6 is native, how reverse DNS works, and whether the address can be moved during a failover. A sophisticated client bringing its own prefix can ask who will originate it, how the ROA will change, which BGP communities are available, and how an emergency withdrawal is authorised. These are better questions because AS149147 exists. The ASN is evidence of a routing control surface, not a certificate for every product claim.

A visible upstream carrier is not a redundancy map

At the observation date, BGP.tools showed one directly visible upstream carrier for AS149147:AS38731, Viettel-CHT. This is a significant external fact about the route graph. It does not prove that GoFiber has only one physical circuit or one internal path. Private interconnections, backup circuits that are not normally advertised, reseller arrangements, and the upstream carrier's own network diversity may not appear as separate direct adjacencies. Conversely, the fact that Viettel-CHT has a large network does not automatically give GoFiber diverse last-mile access.

The distinction matters because GoFiber's 2Gbps announcement invokes resilience during international cable problems. To assess that claim, a buyer needs to know the architecture at the GoFiber edge: number of handover points, physical routes, border routers, upstream contracts, failover policy, domestic peering, and international egress selection. If all customer traffic reaches a single GoFiber edge via one facility or a single carrier handover, the deeper diversity at the carrier does not remove that local dependency.

TheVNNIC 2023 report on internet resources in Vietnamexplains why Vietnamese organisations seek independent IP resources and ASNs: they can support multihoming, proactive ISP selection, peering, and participation in VNIX. The report recorded 663 allocated ASNs and described growing adoption among data centre, cloud, and hosting companies. That establishes the strategic value of an ASN in Vietnam. It does not establish that every holder, including GoFiber, has implemented multihoming.

A buyer should request a current network diagram under confidentiality, then verify selected parts from the outside. Useful evidence includes two or more directly visible upstream ASNs, normal and failover routes, traceroutes from domestic and international probes, maintenance history, and route changes during a controlled test. If there is only one direct upstream, the buyer may still accept the design, but should assess and mitigate that concentration rather than treating ‘having an ASN’ as ‘being carrier-diverse’.

‘Tier 3’ needs a room number

GoFiber states that its physical servers are located in leading Vietnamese ‘Tier 3’ data centres such as FPT and Viettel. The named operators are credible facility providers.Viettel IDCdescribes a national portfolio of Rated-3 facilities, while itscolocation pagedescribes redundant power, cooling, security, carrier access, and 24/7 operations.FPT's data centre documentationalso describes facilities in Hanoi and Ho Chi Minh City and advertises Tier III-oriented design and services.

These first-party facility claims support the proposition that proper commercial data centres exist in the named operators' portfolios. They do not show that a particular GoFiber plan is installed in a specific building, room, or rack. Nor do they show whether GoFiber contracts directly with the facility, buys through a reseller, places its own chassis there, or leases a server operated by someone else.

The blanket phrase ‘Tier 3’ is particularly easy to over-interpret. TIA-942 Rated 3 and Uptime Institute Tier III are related market signals but not interchangeable labels, and certification may apply to design, constructed build, or operations at a named site. A buyer should ask for the exact facility name and address, the relevant certificate and scope, the rack or cage layout, power allocation, interconnection design, remote-hand conditions, and the chain of responsibility for hardware replacement.

Colocation must also be separated from dedicated server rental. In a dedicated rental, the provider typically supplies the machine and the client leases its use. In colocation, the client may own the chassis and buy rack units, power, cooling, network access, and remote hand. GoFiber's broad offering uses both server rental and colocation language, but the accessible public material does not provide a full colocation pricing grid or service schedule.

A colocation client should ask for rack unit pricing, A/B power availability, metering and overage, cross-connect fees, authorised carriers, physical access rules, hardware receiving, spare parts storage, remote-hand rates, insurance responsibilities, and an equipment removal procedure.

This distinction also changes the exit risk. Moving a virtual machine can be a data transfer exercise; removing owned hardware may require authorised visitors, maintenance windows, packaging, shipping, and settlement of setup fees. A contract should specify whether GoFiber, the named data centre operator, or another intermediary controls physical access. A generic reference to an FPT or Viettel facility does not answer the question of who can release a client's server upon termination.

The dedicated server table makes this practical. It advertises one configuration with an Intel Xeon Platinum 8171M and another with an AMD EPYC 7642, each with 16 GB of memory and 600 GB of SAS storage. The table column is labelled SSD while the value says SAS, an internal specification inconsistency that should be resolved in the quote. The client should also establish whether the machine is physically exclusive, whether the storage is a single disk or a protected array, who owns the spare pool, and how quickly failed components are swapped.

Facility location affects more than prestige. It affects latency, data jurisdiction analysis, physical access, carrier choice, and correlated failure. If a client buys a ‘Vietnam VPS’ and a backup service from GoFiber, both may still reside in a single building or a single provider failure domain. A backup is resilient only if its location, credentials, and recovery path survive the event it is supposed to cover.

Support labour is part of the infrastructure

GoFiber repeatedly markets 24/7 support and publishes business and technical phone numbers, chat channels, and email contacts. The homepage advises infrastructure clients to use tickets because tickets are more secure and operationally efficient. That is a sensible distinction: a ticket can better preserve identity, timestamps, diagnostic details, and an escalation trail than an informal discussion.

The public ordering material, however, gives two different trial descriptions. The homepage refers to a 24-hour VPS trial, while theregistration guidestates that VPS and hosting can be tested for five days, or 120 hours, and excludes physical servers, web design, and SEO. The offer may have changed over time. A buyer should obtain the current eligibility, resource limits, payment card or identity requirements, and conversion rules in writing before treating the trial as part of the purchase.

The implementation should be evaluated as a workflow rather than a support slogan:

1. The client identifies whether shared hosting, a root-access VPS, or a physical server matches the responsibility they can carry.
2. The legal entity and billing details are registered. GoFiber'saccount formasks for personal or business status, name, email, phone, address, country, and national identification information.
3. The client receives a trial or paid instance and a precise service description.
4. Migration is performed via a ticket, with an inventory of files, databases, mailboxes, DNS records, certificates, cron jobs, and application secrets.
5. Both parties test the new service before DNS cutover, preserve a rollback path, and record acceptance.
6. Monitoring, backup, patching, and escalation ownership are assigned for steady-state operation.

The quality of this labour can justify paying more than a raw server comparison suggests. It can also be the least scalable part of the business. A provider can add virtual machines faster than it can add experienced engineers who know each client's application. Procurement should therefore measure support, not just confirm that channels exist. During the trial, open one normal technical ticket and one simulated urgent ticket. Record first response, diagnostic quality, ownership, escalation, and resolution, not just whether someone replied.

The service schedule should distinguish response time from restoration time. ‘24/7’ may mean a message is accepted at any hour, not that a qualified engineer will resolve every fault immediately. It should also name supported languages, severity levels, emergency authentication method, planned maintenance notice, remote-hand limitations, and whether post-incident reports are provided.

Billing simplicity has contractual edges

GoFiber supports locally familiar payment pathways. Its public material mentions office payment, bank transfer, Visa, MoMo, and QR methods, and states that service information is sent after payment. Monthly and longer billing cycles suit clients who do not want an international credit card or a foreign-currency cloud invoice. VAT is shown separately on the VPS page, which is an important detail when comparing business costs.

The visible catalogue economics combine several revenue streams:

• project revenue from web design, software development, and search work;
• recurring fees from shared hosting, VPS, and server;
• longer-term prepayment that improves cash flow;
• add-on resource options such as RAM, storage, cores, and IP addresses;
• migration and support labour that can acquire and retain customers;
• possible brokering via named third-party cloud choices shown in the VPS tabs.

The last point requires restraint. The VPS page displays labels including Singapore, DigitalOcean, and OVH among product tabs. A label does not establish whether GoFiber is an authorised reseller, manages a client account, resells its own upstream account, or simply aggregates deployment choices under its interface. Buyers considering these options should ask which legal entity contracts for the upstream service, who owns the cloud account, whether the client can receive native credentials and invoices, and what happens if the GoFiber relationship ends.

The official website links to pages forrefund and cancellation,payment policy,privacy,quality commitments, andsupport submission. At the time of access for this report, these policy bodies could not be reliably retrieved from the public site. That is a limitation of the evidence, not proof that the company lacks a policy or that a client contract is missing terms.

It is nonetheless consequential. Before prepaying, a buyer needs the actual refund formula, cancellation notice, auto-renewal rule, grace period, suspension triggers, data retention window after termination, dispute procedure, and SLA credit mechanism. These provisions determine the economic cost of failure. A 15% annual discount can be erased by an unmanageable migration or by months of unused service that cannot be refunded.

Security claims need a threat model

GoFiber's security language spans several layers. Shared hosting advertises CloudLinux isolation, Imunify360 scanning, SSL, and DDoS protection. The homepage references firewalls, encryption, VM isolation, and continuous monitoring. These are company claims about controls; the public pages do not provide an audit report, configuration baseline, penetration test summary, or named certification that would independently validate how the controls are implemented.

The first procurement task is to separate security by product. On shared hosting, GoFiber may control the host OS, account isolation, malware tools, and the web stack. On a root-access VPS, the client typically controls guest patching, SSH, application secrets, and firewall policy. On a physical server, the client may control even more software but remains dependent on GoFiber for firmware, console access, media management, and network filtering. A generic security promise cannot cover all three responsibility models.

The 2Gbit/s DDoS line needs particular clarification. A useful DDoS service description would state:

• whether detection and scrubbing occur on GoFiber equipment, at Viettel-CHT, or via another cleaning provider;
• whether 2Gbit/s is the total attack traffic, clean traffic, a port limit, or an aggregate ceiling shared among customers;
• which volumetric and protocol attacks are covered;
• whether mitigation is automatic and how fast it activates;
• when traffic is rate-limited or null-routed;
• whether protected and unprotected IP ranges differ;
• what telemetry data and post-attack report the client receives.

Without those details, the number cannot be compared to a workload's risk. Nor can it be assumed to be additive to the announced 2Gbps international capacity. The two may be unrelated, partially overlapping, or constrained at different points.

Backup language needs the same discipline. ‘Backup’ can mean a local copy on the same host, a snapshot on shared storage, a daily copy in a different rack, or a copy with independent credentials in a different facility. Each protects against different failures. The buyer should demand frequency, retention, encryption, immutability, recovery point objective, recovery time objective, test frequency, and restoration fee. For a root VPS, it should be explicit whether backups are included, optional, or entirely the client's responsibility.

Privacy is a concrete operational issue because the account form requests identity and contact data, including a national identification field. Vietnam's telecoms framework now treats data centre and cloud services within a more explicit regulatory structure. TheKPMG overview of Vietnam data centre regulationsexplains that the 2023 Telecommunications Law, effective 2024, brought data centre and cloud services into the value-added telecoms framework. An English rendering ofDecree 163/2024describes customer information and contracting obligations for these services.

Vietnam'sPersonal Data Protection Lawtook effect on 1 January 2026. This article does not make a legal compliance finding. It identifies questions that the public material does not answer: the purpose and retention period of identity data, controller and processor roles, subcontractors, cross-border transfers, access controls, breach notification, deletion after termination, and the avenue for a data subject request. A client handling regulated or sensitive information should obtain a data processing schedule and legal review rather than relying on a general privacy page link.

Absence of a public incident record is not a clean slate

The public sources examined did not yield a verified incident account, breach disclosure, or long-standing public status archive at GoFiber. This statement is deliberately narrower than ‘GoFiber has had no incidents’. Smaller providers often handle incidents through tickets and social channels, and public search coverage may be incomplete. The absence of a found report is a gap in the evidence, not proof of uninterrupted operation.

Cloudflare Radarprovides external views of traffic and routing for AS149147, which can help a client investigate major changes. It is not a substitute for an operator status page because it cannot attribute application errors, storage failures, or maintenance decisions. At the time of review, some of GoFiber's content pages also returned article loading errors. These page errors show a public site quality issue at that time; they do not establish that the VPS or hosting infrastructure was unavailable.

Incident preparedness can be tested contractually. Ask for an anonymised recent incident schedule, the escalation tree, maintenance notice practice, evidence preservation process, and a sample post-incident report. Ask whether support can identify affected hosts and clients, how backups are protected during ransomware or credential compromise, and how emergency changes are authorised. A provider that has not published incidents may still have mature responses. A provider that cannot explain the process asks the client to accept unknown recovery behaviour.

Competing with a control plane, not just a price

The Vietnamese infrastructure market is becoming more crowded. The Ministry of Science and Technology has described a sector led by domestic operators including Viettel IDC, VNPT, FPT, and CMC while attracting international investment indata centre capacity. The US International Trade Administration similarly describes a growingVietnamese data centre market, with regulatory, energy, and capacity considerations. GoFiber therefore sits between the large domestic infrastructure operators, local hosting companies, web agencies, and global self-service clouds.

Its smallest VPS may seem inexpensive, but a clean price comparison is impossible from cores and memory alone. A larger cloud's price may include a documented API, image catalogue, snapshots, metrics, firewall entities, load balancers, account roles, and a defined transfer allowance. GoFiber may include valuable migration and local support that the cloud does not. The buyer must compare the full operational model.

DigitalOcean's Droplet pricingpublicly specifies instance resources, included outbound transfer, and billing increments; itsDroplet product documentalso presents APIs, monitoring, and an availability SLA.Amazon Lightsail pricingbundles compute with stated transfer allowances, while theLightsail service guidedocuments adjacent components such as snapshots, managed databases, load balancers, and content delivery.

These links are not recommendations for a small Vietnamese business to buy an American cloud. They illustrate the category of control-plane and billing evidence against which GoFiber should be tested. Questions include:

• Can an instance be created, rebuilt, and resized via an API, or only via a ticket and portal interface?
• Are machine images, snapshots, firewall rules, and monitoring controlled by the client?
• Is outbound traffic metered, throttled, subject to fair-use rules, or included without quota?
• Can a client export an image, or only application data?
• Are role-based access control, audit logs, and multi-factor authentication available?
• Is a domestic invoice and Vietnamese troubleshooting worth more than infrastructure programmability?

GoFiber's advantage is strongest when the answer to the last question is yes and the workload is relatively conventional. A professional website, a modest database, an internal application, or an agency-managed portfolio can benefit from a local operator. The disadvantage grows as the client needs reproducible deployment, multi-region architecture, granular identity controls, large-scale telemetry, or a managed service ecosystem.

There are also substitutes below and above GoFiber. A client can stay on inexpensive shared hosting and buy application maintenance separately. It can lease directly from a large Vietnamese data centre or cloud operator. It can use a global cloud through a local managed services firm. Or it can use software as a service and avoid server operation entirely. GoFiber wins when its integration removes more labour and uncertainty than its thinner public control-plane documentation adds.

Switching starts before the purchase

GoFiber's promise of free inbound migration reduces one barrier to entry. The harder question is whether egress is also operationalised. A migration can involve application data, DNS, email, IP addresses, certificates, backups, panel licences, monitoring, cloud accounts, and administrator knowledge. If the same provider built the website and runs the server, the concentration is convenient until the client needs to separate them.

Exit rights should therefore be designed before the annual commitment. For shared hosting, the client needs a complete archive of files, databases, mailboxes, and DNS records in usable formats. It should know whether a control panel backup can be restored elsewhere and whether proprietary site components or licences remain valid. For a VPS, the minimum is an application-level export plus reproducible configuration; a full portable machine image is preferable but may not be available. For a physical server, the client must know whether it owns hardware, how drives are sanitised, and whether remote hand is billed during migration.

IP addressing creates special switching costs. A normal address assigned by GoFiber will typically stay with the provider, so the client must change DNS, whitelists, and third-party integrations. Poor DNS TTL management can lengthen cutover. Reverse DNS for mail can delay recovery. If a client brings its own prefix and GoFiber originates it via AS149147, egress may require a new upstream carrier, route object and ROA changes, coordinated announcement and withdrawal, and monitoring to avoid a bogus or hijacked route.

The third-party prefix descriptions visible behind AS149147 make this more than a theoretical question. Any organisation whose address block is originated by GoFiber should have a written procedure for changing origin, emergency withdrawal, access to registry credentials, and proof that its route origin authorisation can be updated without depending on an unavailable individual. Again, routing data does not reveal which organisations have such contracts; it reveals why the contract matters.

The named DigitalOcean and OVH tabs raise another egress issue. If GoFiber provisions a workload in an upstream account it controls, the client may be unable to transfer the server in place. If the client owns the account and delegates management, egress may be much easier. The commercial label does not answer this question. Account ownership, credential custody, billing responsibility, and transfer procedure should appear on the order form.

A practical egress exercise is straightforward: during the trial or first month, build a minimal copy of the workload elsewhere, restore the latest backup, change a test hostname, validate data, and record time and missing dependencies. The exercise uncovers undocumented cron jobs, hardcoded IP addresses, unavailable licences, and backup failures while stakes are low. It also provides a real recovery time estimate instead of a marketing assumption.

A procurement test designed to fail safely

GoFiber can be evaluated without requiring hyperscaler paperwork from a young local provider. The test should be proportionate, but it must exercise the claims that matter.

1. Bind seller and service.Obtain a current business registration document for number 0317495104, confirm the billing entity and bank beneficiary, and have the quote identify the exact product, tax, term, renewal price, setup, resource type, and support limit. If another company supplies the facility, transit, DDoS service, or international cloud account, record that dependency without assuming it is a GoFiber subsidiary.

2. Reconcile public inconsistencies.Ask which trial period applies: 24 hours or 120 hours. Ask whether the shared hosting availability is 99% or 99.9%. Reconcile the 2.09 million VND and 3.09 million VND displays for the 16-core/32 GB plan. Clarify whether the 600 GB dedicated server disk is SAS, SSD, or an array. The goal is not to score small website errors; it is to ensure the signed order has a single unambiguous truth.

3. Define each bandwidth number.For the selected product, ask for domestic and international port speed, committed rate, burst rate, monthly transfer or fair-use threshold, contention policy, and measurement method. Ask whether the advertised 2Gbps is aggregate, per-site, or per-upstream; whether there is a second direct upstream; and how traffic changes during cable faults. For DDoS, ask for detection, scrubbing, clean capacity, null routing, and reporting rules.

4. Inspect the compute denominator.Record the host CPU model, whether a ‘core’ is a vCPU or dedicated core, overcommitment policy, memory guarantees, storage topology, and failure protection. Run CPU, memory, disk latency, and network tests at several times of day with the provider's consent. Examine sustained performance, not just a one-minute spike. On a VPS, observe CPU steal time and disk queue depth; on shared hosting, test the real application under controlled concurrent load.

5. Prove recovery.Trigger a file and database restore from the provided backup process. Record the recovery point, elapsed time, client steps, and fees. Confirm whether the backup resides outside the host, rack, and facility failure domain. A screenshot showing a backup job ran is weaker than a successful restore.

6. Test support as part of the product.Open a routine ticket and an agreed high-severity simulation. Assess triage, first response, diagnosis, escalation, and closure. Confirm emergency authentication so that an attacker cannot convince support to reset a service via a compromised phone or chat account. Ask for maintenance and incident examples.

7. Map the route.Verify the assigned prefix, RPKI status, reverse DNS, and IPv6. Use probes from several Vietnamese and international networks during normal and peak periods. Observe whether the route and latency match the disclosed design. Do not launch DDoS traffic or intrusive security tests without explicit written authorisation.

8. Review security and privacy by responsibility.Obtain the control matrix for shared hosting, VPS, or physical server; backup terms; vulnerability and patching practice; administrator access controls; logging; incident notification; data processing terms; subcontractors; retention; deletion; and cross-border transfer position. Treat product brand names as components, not as proof that the control is configured or monitored.

9. Execute the egress exercise.Export the service, restore it elsewhere, and document DNS, IP, licence, and credential dependencies. Confirm the cancellation and refund procedure, post-termination access period, and proof of deletion. If the provider-managed labour is truly valuable, the exercise will show that value without making the client captive.

10. Commit in stages.Start with a workload whose failure is survivable, use a short term, and extend only after observing performance, recovery, and support. Annual discounts should reward demonstrated fit, not replace due diligence.

This test is deliberately capable of producing a ‘no’. A failed restore, an unexplained route, an ambiguous facility, or weak support escalation should stop a critical deployment. It may still be acceptable for a low-risk site. Procurement maturity lies in matching evidence to consequence rather than declaring the whole provider trustworthy or untrustworthy.

Monitoring points after the first invoice

GoFiber is young enough that its most important evidence will accumulate over time. Customers and market observers should monitor:

• whether AS149147 adds a second directly visible upstream carrier or peering relationships, and whether RPKI validity remains consistent as prefixes change;
• whether GoFiber names exact facilities and publishes a clearer topology for the 2Gbps international capacity claim;
• whether the 99%/99.9%, 24-hour/120-hour, and duplicate VPS price inconsistencies are reconciled;
• whether the policy pages become reliably accessible and specify credits, refunds, suspension, privacy, data retention, and egress;
• whether a public status history and technically useful incident reports emerge;
• whether the portal exposes stronger client controls such as multi-factor authentication, audit logs, API access, snapshots, and role separation;
• whether GoFiber publishes independently attributable case studies with measured migration or operation outcomes;
• whether the growth of routed prefixes is accompanied by clearer explanations of client-owned address space, ROA operations, and emergency route changes.

None of these monitoring points require GoFiber to become a hyperscaler. A local provider can remain small and become much easier to trust by making dependencies, responsibilities, and remedies legible.

The market, simply stated

GoFiber's public evidence supports a more interesting conclusion than ‘just a reseller’ or ‘Vietnamese cloud’. The company has an exact legal identity, a visible autonomous system, a valid route origin practice over the observed IPv4 set, a range of web and infrastructure products, and a local service workflow that can remove real labour for clients. These are substantial assets.

The evidence does not support claims about owned data centre capacity, direct multi-carrier redundancy, customer numbers, guaranteed 2Gbps performance, independently validated availability, or a complete security posture. The named facilities, plan speeds, and controls remain company claims until they are tied to a specific service and independently tested. The visible Viettel-CHT adjacency is useful, but it is not an end-to-end resilience diagram.

GoFiber's small-cloud market is therefore conditional. It can be attractive when a client values Vietnamese support, local payment, migration, and a single supplier for web and infrastructure work. It becomes risky when low prices or an ASN are allowed to stand for a contract, an offline restore test, an egress plan, and an incident schedule. The best client will not ask GoFiber to imitate a global cloud. It will ask the company to make its local advantage measurable: a single legal seller, an explicit responsibility map, a tested recovery path, and numbers that mean the same thing from the marketing page to the incident ticket.