178.137.16.29📋 Copy

## IP Intelligence Briefing: 178.137.16.29/32

Classification: MODERATE RISK | Status: ACTIVE

---

**Executive Summary**

IP address 178.137.16.29 is a residential broadband endpoint operated by Kyivstar PJSC (ASN 15895) located in Kyiv, Ukraine. The IP presents a moderate risk profile (65/100) with no active services detected. The IP belongs to a high-abuse density subnet (178.137.16.0/24) with 65.62% abuse classification. No active threat campaigns or malicious indicators were observed.

---

**Ownership & Geolocation**

---

**Network Profile**

• Risk Score: 65/100 (Moderate Risk)
• Network Role: Firewalled / No Services
• DNS: Forward resolved to `178-137-16-29.broadband.kyivstar.net`
• PTR: `178-137-16-29.broadband.kyivstar.net`
• Open Ports: None detected
• TLS/HTTPS: No certificates or services observed

---

**Threat Indicators**

• Blacklist Count: 0
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Threat Feeds: None
• Campaign Matches: None

DNSBL Status: Listed on 3 of 8 threat feeds (operator score: 0.1304 / "Minimal")

---

**Neighborhood Analysis**

The /24 subnet (178.137.16.0/24) shows elevated abuse characteristics:

Multiple neighboring IPs in the /24 share similar risk scores (65/100), indicating this is a high-traffic residential broadband segment with elevated abuse potential.

---

**Historical Observations**

• Total Observations: 24
• Observation Window: June 2026
• Recent Signals:

- 2026-06-24: Minimal operator score (0.60 confidence)

- 2026-06-07: Minimal operator score (0.60 confidence)

- 2026-06-03: Kyiv geolocation confirmed (0.60 confidence)

The IP shows persistent ownership with no recent ownership changes. Threat persistence: 0 days.

---

**Relationship Graph**

• Total Relationships: 55
• Network Connections: Multiple "Same Network" relationships to KYIVSTAR-NET-7
• No Direct Links: No associations with known malicious organizations, hostnames, or certificates

---

**Recommended Actions**

Immediate Mitigation:

```bash

# iptables

iptables -A INPUT -s 178.137.16.29 -j DROP

# nftables

nft add rule inet filter input ip saddr 178.137.16.29 drop

```

Cloud/WAF Rules:

• Cloudflare WAF: Block IP with expression `ip.src eq 178.137.16.29`
• AWS WAF: Add 178.137.16.29/32 to blocked addresses
• pfsSense: Block 178.137.16.29/32

Monitoring: Increase logging verbosity and review recent activity from this IP due to elevated risk score (65/100).

---

**Intelligence Assessment**

This IP represents a standard residential broadband connection from Kyivstar's infrastructure. While not directly associated with active threats, the high abuse density of the /24 subnet suggests potential for opportunistic abuse. SOC teams should treat this as a moderate risk endpoint and consider blocking at the perimeter, particularly if observed in conjunction with suspicious traffic patterns.

Priority: MEDIUM | Confidence: 75% | Last Updated: 2026-06-24

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.