An attacker could try to bypass a hostname-based whitelist on your server.
In a naive scenario, you might configure SSH or a firewall to only allow connections from
"localhost", intending to lock out all remote machines for security reasons.
A smart SSH server would recognize that
220.127.116.11 is remote and block the connection attempt. Eventually, it would resolve
127.0.0.1 and see that the IPs don't match.
However, a server with a flawed implementation might first conduct a reverse DNS lookup of the IP, find the
localhost entry, and reason that the hostnames match, thus allowing the connection.
127.0.0.1 is obviously done internally in most cases, skipping the DNS query (e.g. by looking it up in
/etc/hosts). Hence, a malicious DNS server cannot easily attack the other way round by resolving
localhost to an arbitrary IP.
Why does that particular IP resolve to localhost?
Here, it's likely not part of an attack, but because that IP is located in Hanoi and apparently, "The Country of Vietnam Resolves to Localhost". The reason seems to be an outdated technique to bypass e-mail spam filters.