176.103.2.180📋 Copy

# IP Intelligence Briefing: 176.103.2.180

Classification: Moderate Risk

Analysis Date: Current

Report Type: Single IP Intelligence

---

## Executive Summary

IP address 176.103.2.180 is associated with network operator DIALOGKOM-MNT (ASN 56812) and geolocated to Balakliya, Kharkivs'ka Oblast', Ukraine. The IP carries a moderate risk score of 40 and is currently classified as "Firewalled / No Services" with no active open ports or TLS certificates. While the IP itself shows no direct threat indicators, the surrounding /24 subnet demonstrates mixed traffic patterns with measurable abuse density.

---

## Technical Profile

Ownership & Registration:

• ASN: 56812 (DIALOGKOM-MNT)
• RIR: RIPE
• BGP Prefix: 176.103.0.0/20
• Route Stability: Unstable (false)
• Control Plane Origin: ASN 56812

Geolocation:

• Country: Ukraine (UA)
• Region: Kharkivs'ka Oblast'
• City: Balakliya
• Geographic Confidence: Consensus-based across multiple sources (500km accuracy radius)

Network Classification:

• Infrastructure Type: Non-provider, non-hosting
• Service Purpose: Firewalled / No Services
• DNS Resolution: No PTR records, no forward resolution
• Email Auth: No SPF or DMARC records

---

## Threat Assessment

Current Risk Score: 40 (Moderate)

Threat Indicators:

• Blacklist Status: Listed on 2 of 8 DNSBLs
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Known Campaigns: None correlated

Behavioral Signals:

• Service Enumeration: None detected
• WAF Violations: 0
• Honeypot Hits: 0
• Total Incidents: 0

Operator Assessment: 0.1304 (Minimal)

---

## Neighborhood Analysis

Subnet: 176.103.2.0/24

Total Siblings: 54 IPs analyzed

Abuse Density: 0.037 (low-moderate)

Risk Distribution:

• High Risk: 2 IPs
• Medium Risk: 33 IPs
• Low Risk: 19 IPs

Key Observations:

• Multiple sibling IPs with risk scores of 40-55
• Neighborhood classification: Mixed
• Inherited risk score: 14
• 14 threat-related siblings identified

---

## Historical Trajectory

Observation Count: 17 historical signals

Temporal Analysis:

• Ownership changes: 0
• Threat persistence: No persistent malicious activity detected
• Threat observation count: 1
• Is persistently malicious: No

Recent observations (June 2026) indicate stable routing and geolocation data with no significant degradation in signal quality or increased threat activity over the observation window.

---

## Relationship Graph

Primary Association: DIALOG-NET network (20 relationship entries)

• All detected relationships map to the same network entity
• No certificate associations detected
• No correlated IP addresses beyond subnet boundaries

---

## Recommended Actions

Firewall Blocking Rules:

*iptables:*

```

iptables -A INPUT -s 176.103.2.180 -j DROP

```

*nftables:*

```

nft add rule inet filter input ip saddr 176.103.2.180 drop

```

*nginx:*

```

deny 176.103.2.180;

```

*Cloudflare WAF:*

```json

{

"description": "Block 176.103.2.180 — IPDebrief risk score 40",

"action": "block",

"filter": {"expression": "ip.src eq 176.103.2.180"}

}

```

*AWS WAF:*

```json

{

"Addresses": ["176.103.2.180/32"],

"Description": "IPDebrief risk 40"

}

```

Recommendation: While the IP currently shows no active exploitation indicators, the moderate risk score (40) combined with subnet-level abuse density warrants blocking at the perimeter. Consider implementing rate-limiting for the broader /24 subnet if traffic patterns warrant additional scrutiny.

---

Disclaimer: This intelligence is derived from IPDebrief platform data and should be validated against additional threat indicators before operational implementation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.