182.184.173.54📋 Copy

# IP Intelligence Briefing: 182.184.173.54

## Overview

IP address 182.184.173.54 is registered to Pakistan Telecommunication Company Limited (PTCL) under AS17557. The asset is geolocated to Rawalpindi, Punjab, Pakistan (APNIC RIR). Current risk assessment indicates Moderate Risk (Score: 50).

## Ownership & Network Classification

• ASN: 17557 (PTCL)
• Organization: Munir Ahmed / PTCL
• CIDR Block: 182.184.0.0/16
• RIR: APNIC
• Network Role: Firewalled / No Services Detected
• Classification: Not identified as cloud, CDN, proxy, VPN, or hosting infrastructure

## Threat Indicators

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0 active lists
• Abuse Confidence Score: Not assigned
• Known Campaigns: None detected
• Threat Feeds: Empty

## Technical Observations

• Open Ports: None detected
• DNS Records: No PTR hostnames, forward resolution inactive
• TLS/Certificates: No valid certificates
• HTTP Services: No active web content
• DNSBL Listings: 2 of 8 total lists (minimal operator score: 0.1304)
• Route Stability: Not stable (route changes observed in 30-day window)

## Neighborhood Analysis

• Subnet: 182.184.173.54/24
• Abuse Density: 0
• Threat Siblings: 0
• Total Siblings: 0 detected

## Historical Signal Analysis

Fifteen signal observations recorded through July 30, 2026. Key patterns include:

• ASN verification confirmed via AlienVault-OTX (AS17557)
• Geolocation signals showed inconsistent reporting (Marseille, FR vs. Rawalpindi, PK)
• Subnet classification remained "clean" with inherited risk of 0
• No persistent malicious activity detected
• No ownership changes or threat persistence indicators

## Relationship Graph

• Three "Same Network" relationships to PTCL domain

## SOC Recommendations

1. Traffic Monitoring: No immediate action required; IP shows no active service exposure

2. Firewall Rules: No specific blocking rules recommended based on current risk profile

3. Monitoring Priority: Low to Moderate (risk score 50)

4. Geolocation Discrepancy: Investigate inconsistent geolocation signals (FR vs PK) for potential spoofing

5. DNSBL Review: Monitor the 2 DNSBL listings; may indicate historical or potential future abuse

## Risk Assessment Summary

The IP address presents a moderate risk profile with no current active threat indicators. The subnet demonstrates clean abuse density with no neighboring threat activity. Historical signals show no persistent malicious behavior, though geolocation inconsistencies warrant monitoring. No immediate blocking required, but maintain awareness of DNSBL listings and geolocation validation discrepancies.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.