182.177.113.87📋 Copy

INTELLIGENCE BRIEFING: IP 182.177.113.87/32

Executive Summary

IP address 182.177.113.87/32 presents elevated risk (Score: 80/100) with conflicting geolocation signals and DNSBL listings. The IP is attributed to PTCL (ASN: 17557) but shows inconsistent geolocation data between Pakistan (ASN registration) and France (Marseille, FR). No open services detected on the target.

Ownership and Registration

• ASN: 17557
• Organization: Pakistan Telecommunication Company Limited (PTCL)
• CIDR Block: 182.177.0.0/16
• RIR: APNIC

Geolocation Analysis

Conflicting signals observed:

• ASN Registration: Pakistan (PK)
• Geolocation Data: France, Marseille (FR)
• This discrepancy warrants investigation for potential proxy/TOR usage or misattribution

Threat Indicators

• Risk Score: 80/100 (High Risk)
• DNSBL Listings: Listed on 4 of 8 blacklists
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Open Ports: None detected (Firewalled/No Services)

Network Behavior

• BGP Prefix: 182.177.96.0/19
• Route Stability: Unstable (0 route changes in 30 days, isRouteStable: false)
• Control Plane Operator Score: 0.1304 (Minimal)
• Subnet Classification: Clean (182.177.113.87/24)
• Neighborhood Abuse Density: 0%

Observation History

Fourteen observations recorded, including:

• Traceroute path through Comcast with 30 hops
• Multiple ASN and geolocation signal variations
• No persistent threat patterns observed

Associated Relationships

• Four relationships identified to PTCL network infrastructure
• No direct links to subnets, hostnames, organizations, or certificates beyond network attribution

Recommended Actions

Immediate (Critical):

1. Increase logging verbosity for traffic from this IP

2. Implement blocking rules across perimeter defenses

Firewall Rules:

• iptables: `iptables -A INPUT -s 182.177.113.87 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 182.177.113.87 drop`
• nginx: `deny 182.177.113.87;`
• pfSense: `182.177.113.87/32`
• Cloudflare WAF: Block with expression `ip.src eq 182.177.113.87`
• AWS WAF: Add address `182.177.113.87/32`

SOC Analyst Notes:

• Monitor for traffic patterns despite lack of open services
• Investigate geolocation discrepancy between ASN and geolocation data
• Review DNSBL listing rationale (4/8 lists)
• Consider subnet-level monitoring for correlated activity in 182.177.0.0/16
• Route instability may indicate dynamic allocation or hijacking activity

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.