105.163.0.166📋 Copy

# IPDebrief Intelligence Briefing: 105.163.0.166/32

Classification: Moderate Risk (55/100) | Last Updated: 2026-07-29 | Status: Active

---

## Executive Summary

IP 105.163.0.166 is classified as a moderate-risk mobile endpoint with no observed malicious activity. The address operates on Safaricom's LTE network (Kenya) with geolocation data indicating London, GB—a discrepancy suggesting routing anomalies or mobile traffic masquerading. No open services detected; the endpoint appears firewalled with minimal network footprint.

---

## Technical Profile

---

## Threat Assessment

• Malicious Activity: No detected campaigns, known attacker status, or spam indicators
• Tor/Proxy: Not identified as Tor exit node or proxy
• Persistence: No persistent malicious behavior observed
• Control Plane: BGP prefix 105.163.0.0/24, route stability concerns flagged
• DNSBL Presence: 3 listings across 8 total lists—monitor for escalation

---

## Neighborhood Context (105.163.0.0/24)

• Subnet Classification: Mostly clean
• Abuse Density: 0.2 (low-moderate)
• Risk Distribution: 0 high, 2 medium, 2 low
• Notable Neighbors:

- 105.163.0.146 (Risk: 55)

- 105.163.0.196 (Risk: 55)

- 105.163.0.82 (Risk: 30)

- 105.163.0.163 (Risk: 30)

---

## Observation History (15 Total Signals)

Recent observations show consistent low-to-moderate confidence signals for mobile network classification, with no escalation in threat indicators. No ownership changes or threat persistence observed.

---

## Recommended Actions

Immediate: Increase logging verbosity and review recent activity from this IP.

Firewall Implementation:

```bash

# iptables

iptables -A INPUT -s 105.163.0.166 -j DROP

# nftables

nft add rule inet filter input ip saddr 105.163.0.166 drop

# nginx

deny 105.163.0.166;

# pfSense

105.163.0.166/32

# Cloudflare WAF

Block: ip.src eq 105.163.0.166

# AWS WAF

Addresses: 105.163.0.166/32

Description: IPDebrief risk 55

```

---

## Analyst Notes

The geolocation discrepancy between GB and KE carrier data warrants monitoring. While current risk indicators remain moderate, the 3 DNSBL listings suggest potential prior abuse. Implement logging for 72 hours to validate baseline activity before applying blocking rules.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.