# 176.103.7.52 — IP Intelligence Summary 176.103.7.52 is an IPv4 address operated by DIALOGKOM-MNT (AS56812), geolocated to Balakliya, Ukraine. As of September 2, 2026, IPDebrief rates it High Risk (70/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/176.103.7.52 - Last updated: 2026-09-02 ## Ownership - Organization: DIALOGKOM-MNT - Network name: DIALOG-NET - Allocated block: 176.103.0.0/19 - ASN: AS56812 (https://ipdebrief.com/asn/56812) - Regional registry: RIPE ## Location - City: Balakliya - Region: Kharkivs’ka Oblast’ - Country: Ukraine - Time zone: Europe/Kyiv ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: High Risk (70/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Exposed services - 80/tcp — http - 443/tcp — https ## Analyst narrative \# IP INTELLIGENCE BRIEFING **Target:** 176.103.7.52/32 **Classification:** Web Server / Infrastructure Node **Date:** 2026-07-27 \--- \## EXECUTIVE SUMMARY IP 176.103.7.52 presents a low-risk profile with a risk score of 0. Current profile indicates a London-based web server (GB), but historical data reveals conflicting geolocation signals pointing to Ukraine. The IP operates a lighttpd web server with standard HTTP/HTTPS services and exhibits no active threat indicators. However, recent blacklist activity and routing instability warrant monitoring. \--- \## INFRASTRUCTURE PROFILE **Ownership:** ASN 56812 (ASZARKO - CHP Zarko Alexandr Ivanovich, UA) **BGP Prefix:** 176.103.0.0/20 **Location:** London, GB (current consensus) / Ukraine, UA (historical) **Service:** Web Server (HTTP/HTTPS) **Server Software:** lighttpd/1.4.39 **Ports:** 80/tcp, 443/tcp **Routing Status:** Unstable (route changes observed within 30-day window) **DNSSEC:** Valid **PTR Record:** None **Reverse DNS:** Not resolved \--- \## THREAT INDICATORS **Current Risk Score:** 0 (Low Risk) **Blacklist Status:** 4 of 8 total listings (historical observation) **Threat Severity:** High (on listed feeds) **Known Campaigns:** None identified **Tor/Proxy/VPN:** Negative for all categories **Abuse Confidence Score:** Not reported \--- \## OBSERVATION HISTORY (Last 10 Signals) Recent observations reveal concerning patterns: \- **Geolocation Discrepancy:** Historical signals (2026-07-27) indicate Ukraine coordinates (48.38, 31.17) with 500km accuracy \- **Blacklist Activity:** 4 blacklist listings identified with high severity ratings \- **DNSSEC:** Validated (signed zone 52.7.103.176.in-addr.arpa) \- **Ownership Persistence:** No ownership changes recorded \- **Threat Persistence:** No persistent malicious activity detected \--- \## SUBNET ANALYSIS (176.103.7.0/24) **Total Neighbors:** 73 IPs **Abuse Density:** 0% **Risk Distribution:** \- High Risk: 0 \- Medium Risk: 50 (68.5%) \- Low Risk: 23 (31.5%) **Notable Neighbor IPs:** | IP Address | Risk Score | Authority Score | |------------|-----------|-----------------| | 176.103.7.9 | 70 | 50 | | 176.103.7.17 | 55 | 50 | | 176.103.7.6 | 40 | 50 | | 176.103.7.13 | 15 | 50 | | 176.103.7.18 | 0 | 50 | *Subnet exhibits elevated medium-risk activity concentration.* \--- \## RELATIONSHIP GRAPH No direct relationships identified with other IPs, hostnames, organizations, or certificates. \--- \## NETWORK BEHAVIOR **Traceroute:** 21 hops (Comcast, Cogent transit networks) **RTT:** 0.1ms (first hop) to 138.3ms (last hop) **Honeypot Hits:** 0 **Enumeration Strikes:** 0 **WAF Violations:** Not observed \--- \## SECURITY RECOMMENDATIONS **Current Action:** Monitor **Justification:** Low-risk profile with no active threat indicators. However, the following factors warrant continued observation: 1. Geographic inconsistency (GB vs UA) 2. Blacklist history with high-severity entries 3. Routing instability in parent prefix 4. Subnet-level medium-risk concentration (50/73 IPs) **Firewall Rules:** No specific blocking rules recommended at this time. Allow traffic if required for business operations, but monitor for behavioral anomalies. \--- \## CONCLUSION IP 176.103.7.52 is classified as low-risk with no current active threats. The infrastructure appears to be a standard web server with legitimate service purposes. Historical blacklist activity and geolocation discrepancies suggest the need for continued monitoring, but no immediate blocking action is warranted. The parent subnet (176.103.7.0/24) exhibits moderate risk concentration that should be factored into broader subnet-level security policies. ## Nearby addresses - 176.103.7.0 (https://ipdebrief.com/176.103.7.0) - 176.103.7.4 (https://ipdebrief.com/176.103.7.4) - 176.103.7.5 (https://ipdebrief.com/176.103.7.5) - 176.103.7.6 (https://ipdebrief.com/176.103.7.6) - 176.103.7.9 (https://ipdebrief.com/176.103.7.9) - 176.103.7.13 (https://ipdebrief.com/176.103.7.13) - 176.103.7.17 (https://ipdebrief.com/176.103.7.17) - 176.103.7.18 (https://ipdebrief.com/176.103.7.18) - 176.103.7.19 (https://ipdebrief.com/176.103.7.19) - 176.103.7.25 (https://ipdebrief.com/176.103.7.25) - 176.103.7.26 (https://ipdebrief.com/176.103.7.26) - 176.103.7.27 (https://ipdebrief.com/176.103.7.27) --- Source: IPDebrief, "176.103.7.52 IP intelligence", https://ipdebrief.com/176.103.7.52, updated 2026-09-02. Assessments are probabilistic.