# 176.103.25.156 — IP Intelligence Summary

176.103.25.156 is an IPv4 address operated by DIALOGKOM-MNT (AS56812), geolocated to Kharkiv, Ukraine. As of October 6, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/176.103.25.156
- Last updated: 2026-10-06

## Ownership

- Organization: DIALOGKOM-MNT
- Network name: DIALOG-NET
- Allocated block: 176.103.0.0/19
- ASN: AS56812 (https://ipdebrief.com/asn/56812)
- Regional registry: RIPE

## Location

- City: Kharkiv
- Region: Kharkivs’ka Oblast’
- Country: Ukraine
- Time zone: Europe/Kyiv

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (40/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\## IP INTELLIGENCE BRIEFING: 176.103.25.156

**Classification:** High Risk (Score: 80/100)

**Report Date:** Current Analysis

**Status:** Active Monitoring Required

\---

\### EXECUTIVE SUMMARY

IP address 176.103.25.156 is registered to DIALOG-NET (ASN 56812) and is geolocated to Kharkiv, Ukraine. The IP presents an elevated threat profile with a risk score of 80/100. While no active threat campaigns or known attacker indicators are currently associated with this address, the subnet exhibits moderate abuse density (18.5%) with multiple high-risk neighbors. Recommended immediate action is to increase logging verbosity and consider blocking at the network perimeter.

\---

\### OWNERSHIP & INFRASTRUCTURE

\- **Organization:** DIALOG-NET

\- **ASN:** 56812

\- **CIDR Block:** 176.103.0.0/19

\- **RIR:** RIPE (Eastern Europe)

\- **Infrastructure Type:** Web Server

\- **Network Classification:** Non-CDN, Non-Proxy, Non-VPN

\### GEOLOCATION

\- **Country:** Ukraine (UA)

\- **Region:** Kharkivs'ka Oblast'

\- **City:** Kharkiv

\- **Coordinates:** 48.38°N, 31.17°E

\- **Accuracy Radius:** 500km (Multi-signal inference)

\- **Consensus:** Validated across 1 source

\- **RTT Analysis:** Average 139.6ms (5 probes)

\### NETWORK SERVICES

\- **Open Ports:** TCP/80 (HTTP), TCP/443 (HTTPS)

\- **Server Banner:** lighttpd/1.4.39

\- **TLS Certificate:** Not observed

\- **DNS Records:** No reverse DNS resolution; no SPF/DMARC records configured

\### THREAT INDICATORS

\- **Risk Score:** 80/100 (High Risk)

\- **DNSBL Listings:** 4 of 8 total lists

\- **Known Campaigns:** None detected

\- **Tor Exit Node:** No

\- **Known Attacker:** No

\- **Spam Source:** No

\- **Blacklist Count:** 0 (public blacklists)

\- **Route Stability:** Unstable (isRouteStable: false)

\### SUBNET NEIGHBORHOOD ANALYSIS

\- **Subnet:** 176.103.25.156/24

\- **Total Siblings:** 28

\- **Active Siblings:** 10

\- **Abuse Density:** 0.185 (18.5%)

\- **Risk Distribution:**

\- High Risk (80): 5 IPs

\- Medium Risk (30-59): 13 IPs

\- Low Risk (0-29): 8 IPs

**High-Risk Neighbors Identified:**

\- 176.103.25.30 (Score: 80)

\- 176.103.25.95 (Score: 80)

\- 176.103.25.172 (Score: 80)

\- 176.103.25.189 (Score: 80)

\- 176.103.25.198 (Score: 80)

\---

\### OBSERVATION HISTORY

Analysis of 17 observations reveals the following temporal patterns:

\- **Recent Activity:** Multiple network traces confirming connectivity through 20-hop paths

\- **Subnet Classification:** Consistently reported as "clean" with low inherited risk

\- **Geolocation Signals:** All observations confirm Ukraine-based location

\- **Threat Persistence:** No persistent malicious behavior observed (0 threat observation count)

\---

\### RELATIONSHIP GRAPH

Five relationships identified, all classified as "Same Network" connections to DIALOG-NET. No certificate, hostname, or organizational cross-references detected.

\---

\### RECOMMENDED SECURITY ACTIONS

**IMMEDIATE ACTIONS:**

1. **Increase Logging Verbosity:** Monitor all activity from this IP address

2. **Firewall Blocking:** Implement blocking rules across perimeter devices

**Firewall Rules:**

\`\`\`

iptables: iptables -A INPUT -s 176.103.25.156 -j DROP

nftables: nft add rule inet filter input ip saddr 176.103.25.156 drop

nginx: deny 176.103.25.156;

pfsense: 176.103.25.156/32

Cloudflare WAF: Block with expression "ip.src eq 176.103.25.156"

AWS WAF: Add to block list "176.103.25.156/32"

\`\`\`

\---

\### SOC ANALYST NOTES

This IP is associated with a Ukrainian hosting provider network showing elevated risk characteristics. The subnet's abuse density suggests potential for coordinated activity. While this specific IP lacks direct threat indicators, the presence of five additional high-risk neighbors warrants monitoring the entire /24 subnet for related malicious activity. Recommend correlating with any inbound connection attempts from the neighborhood IPs (176.103.25.30, 176.103.25.95, 176.103.25.172, 176.103.25.189, 176.103.25.198).

**Priority:** Medium-High

**Action Window:** Immediate

## Nearby addresses

- 176.103.25.3 (https://ipdebrief.com/176.103.25.3)
- 176.103.25.30 (https://ipdebrief.com/176.103.25.30)
- 176.103.25.31 (https://ipdebrief.com/176.103.25.31)
- 176.103.25.32 (https://ipdebrief.com/176.103.25.32)
- 176.103.25.34 (https://ipdebrief.com/176.103.25.34)
- 176.103.25.51 (https://ipdebrief.com/176.103.25.51)
- 176.103.25.55 (https://ipdebrief.com/176.103.25.55)
- 176.103.25.57 (https://ipdebrief.com/176.103.25.57)
- 176.103.25.63 (https://ipdebrief.com/176.103.25.63)
- 176.103.25.77 (https://ipdebrief.com/176.103.25.77)
- 176.103.25.82 (https://ipdebrief.com/176.103.25.82)
- 176.103.25.83 (https://ipdebrief.com/176.103.25.83)

---

Source: IPDebrief, "176.103.25.156 IP intelligence", https://ipdebrief.com/176.103.25.156, updated 2026-10-06. Assessments are probabilistic.