172.204.32.13📋 Copy

# IP Intelligence Briefing: 172.204.32.13/32

## Executive Summary

IP 172.204.32.13 presents a moderate risk profile (score: 50) with Microsoft Azure cloud infrastructure hosting. The IP has been observed on multiple DNS blacklists with high-severity listings and exhibits route stability anomalies in its control plane. No malicious activity was directly confirmed, but defensive blocking is recommended pending further correlation.

## Infrastructure Profile

## Network Classification

The IP is classified as cloud infrastructure with hosting capabilities. Open port 22/SSH detected with OpenSSH 9.6p1 Ubuntu banner. DNS resolution is not forward-confirmed, and no reverse PTR records exist.

## Threat Indicators

• DNSBL Listings: 2 out of 8 blacklist checks returned positive results
• Control Plane Status: Route stability flagged as unstable (`isRouteStable: false`)
• Operator Score: 0.1304 (Minimal)
• Geo Validation: ICMP probe blocked, unable to validate geolocation accuracy

## Observation History (21 records)

Recent activity shows multiple signal types from 2026-08-12:

• Network classification consistently identified as Microsoft Azure cloud infrastructure
• DNSBL listings observed with high severity classifications
• Geolocation inference pointing to New Zealand (Auckland region)
• Operator score maintained at minimal risk level

## Neighborhood Analysis

Subnet 172.204.32.13/24 assessment:

• Abuse Density: 0
• Classification: Clean
• Active Siblings: 1 (total: 1)
• Threat Siblings: 0

No correlated threat activity detected within the immediate subnet.

## Recommended Actions

Firewall blocking rules generated for deployment:

• iptables: `iptables -A INPUT -s 172.204.32.13 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 172.204.32.13 drop`
• nginx: `deny 172.204.32.13;`
• Cloudflare WAF: Block with filter expression `ip.src eq 172.204.32.13`
• AWS WAF: Add to blocklist with address `172.204.32.13/32`

## Intelligence Assessment

The IP operates from Microsoft Azure infrastructure with moderate risk scoring driven primarily by DNSBL presence. Route stability issues suggest potential infrastructure churn. While no active threat indicators were confirmed, the combination of blacklist presence and control plane anomalies warrants defensive blocking until further correlation confirms benign activity.

---

*Report generated from IPDebrief intelligence platform data*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.