176.12.72.113📋 Copy

# IP Intelligence Briefing: 176.12.72.113/32

Classification: Moderate Risk (Score: 40)

Date: 2026-07-27

Prepared For: SOC Analyst

---

## Executive Summary

IP address 176.12.72.113 is a Kazakhstani host registered to noc.hostlab (ASN 205431) within the KZ-HOSTLAB network (176.12.72.0/21). The IP presents a moderate risk score of 40 with no active threat indicators, no known malicious campaigns, and zero blacklist associations. The subnet exhibits low abuse density with one neighboring IP (176.12.72.69) showing a risk score of 30. No services are actively listening on the target IP.

---

## Technical Profile

Ownership & Network

• Organization: noc.hostlab
• Netname: KZ-HOSTLAB
• CIDR Block: 176.12.72.0/21
• ASN: 205431
• RIR: RIPE
• Abuse Contact: abuse@hostlab.kz

Geolocation

• Country: Kazakhstan (KZ)
• Region: Almaty
• City: Almaty
• Coordinates: 43.25°N, 76.91°E
• Geolocation Confidence: Plausible

Network Services

• Open Ports: None detected
• Status: Firewalled / No Services
• TLS Certificates: None
• HTTP Banner: None

DNS Resolution

• PTR Hostname: a240569.hlab.kz
• Forward Resolution: Confirmed
• Domain: hlab.kz
• Hosted Domains: None
• Email Authentication: SPF/DMARC not configured

---

## Threat Assessment

Current Risk Indicators

• Risk Score: 40 (Moderate)
• Blacklist Count: 0
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Abuse Confidence Score: Not applicable

Control Plane Data

• Route Stability: Not stable
• DNSBL Listings: 2 of 8 total lists
• Operator Score: 0.2609 (Basic)
• RPKI State: Not assessed
• IRR Consistency: Not assessed

---

## Temporal Analysis

Observation History (15 observations)

• Most Recent Signal: 2026-07-27 22:53:56 UTC
• Ownership Changes: 0 (Stable)
• Threat Persistence Days: 0
• Persistently Malicious: False

Trend Analysis

No significant changes in ownership, geolocation, or threat posture detected. The IP has maintained consistent registration to noc.hostlab since initial observation. No escalation of threat signals observed.

---

## Network Relationships

DNS Associations

• a240569.hlab.kz (multiple associations)

Network Relationships

• KZ-HOSTLAB (same network)

Relationship Count: 5

---

## Subnet Analysis (176.12.72.0/24)

• Neighbor Count: 1
• Abuse Density: 0
• Risk Distribution: 1 low risk IP
• Neighbor IP: 176.12.72.69 (Risk: 30, Authority: 60)

---

## Recommended Actions

Firewall Rules

iptables:

```

iptables -A INPUT -s 176.12.72.113 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 176.12.72.113 drop

```

nginx:

```

deny 176.12.72.113;

```

Cloudflare WAF:

```json

{

"description": "Block 176.12.72.113 — IPDebrief risk score 40",

"action": "block",

"filter": {"expression": "ip.src eq 176.12.72.113"}

}

```

AWS WAF:

```json

{

"Addresses": ["176.12.72.113/32"],

"Description": "IPDebrief risk 40"

}

```

---

## Intelligence Conclusions

1. Risk Level: Moderate (40/100) — Block if policy permits, but not a confirmed threat

2. Threat Posture: No active malicious activity detected; IP is currently firewalled

3. Geographic Origin: Kazakhstan (Almaty) — Legitimate hosting infrastructure

4. Network Reputation: Low abuse density; neighbor subnet shows minimal risk

5. Recommendation: Monitor for service activation; consider blocking per organization policy if risk threshold is exceeded

Final Assessment: This IP represents a low-priority defensive concern. The moderate risk score reflects the presence of DNSBL listings rather than confirmed malicious activity. No immediate threat indicators warrant urgent action.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.