172.196.32.64📋 Copy

# IP Intelligence Briefing: 172.196.32.64/32

## Executive Summary

IP 172.196.32.64 is classified as Moderate Risk (Risk Score: 40). The address is hosted on Microsoft Azure cloud infrastructure under ASN 8075. While no active threat indicators are present, conflicting geolocation signals and DNSBL listings warrant monitoring.

---

## Current Risk Profile

---

## Threat Indicators

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0
• Threat Feeds: None detected
• Abuse Confidence Score: Not available

---

## Network Classification

• Infrastructure Type: CloudCompute
• Provider: Microsoft Azure
• Hosting: Yes
• Open Ports: None detected
• TLS Certificate: None
• Active Services: No open services identified

---

## Control Plane Analysis

• Origin ASN: 8075
• BGP Prefix: 172.192.0.0/13
• Route Stability: Unstable (isRouteStable: false)
• DNSBL Status: Listed on 2 of 8 checks
• RPKI State: Not verified
• IRR Consistency: Not verified

---

## Geolocation Intelligence

Significant signal inconsistency observed:

• Primary Location: Auckland, NZ
• Conflicting Signal: Australia (AU) detected via AlienVault OTX
• GeoPlausible Flag: False (indicates location validation failure)
• Consensus: False (multiple conflicting sources)

---

## Observation History (15 Signals)

Recent observations reveal notable signal conflicts:

1. Ownership Attribution: Confirmed to "Divya Quamara" via ARIN

2. Geolocation Conflict: One signal identified as "foxtel management pty ltd" (AU) with threat indicators; another shows Microsoft Azure infrastructure

3. Threat Persistence: 0 days observed

4. Malicious Activity: Not persistently malicious

---

## Subnet Analysis (172.196.32.0/24)

• Neighbor Count: 0 siblings detected
• Abuse Density: 0
• Risk Distribution: None (high/medium/low = 0)
• Classification: No inherited risk from subnet

---

## Related Entities

• Network Relationships: 2 entries (both "Same Network" type pointing to "cloud")
• No Associated Hostnames: None identified
• No Certificate Associations: None detected

---

## Recommended Actions

Firewall Rules (iptables/nftables)

```bash

# Block outbound traffic from this IP (if observed externally)

iptables -A OUTPUT -d 172.196.32.64 -j DROP

iptables -A OUTPUT -p tcp --dport 80 -d 172.196.32.64 -j DROP

iptables -A OUTPUT -p tcp --dport 443 -d 172.196.32.64 -j DROP

```

WAF Rules (Cloudflare/AWS)

```yaml

# Block IP at WAF level

ip: 172.196.32.64

action: block

reason: moderate-risk-cloud-traffic

```

Monitoring Priority

• Medium Priority: Monitor for increased activity from this IP
• Watch List: DNSBL listings may increase
• Geolocation Validation: Continue monitoring for location signal consistency

---

## Analyst Notes

This IP presents a moderate risk profile primarily due to conflicting geolocation signals and DNSBL listings. The Microsoft Azure cloud hosting context suggests legitimate cloud infrastructure, but the location inconsistencies (NZ vs AU) and the "foxtel management pty ltd" association require continued observation. No active exploitation indicators or malicious behavior have been detected. Recommend standard monitoring protocols with escalation if threat indicators emerge.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.