185.139.138.193📋 Copy

# IP Intelligence Briefing: 185.139.138.193

Classification: Moderate Risk (Score: 40/100)

Date of Analysis: 2026-07-22

Report Type: Threat Intelligence Summary

## Executive Summary

IP address 185.139.138.193 operates within Uzbekistan's Tashkent region under ASN 201767, registered to Khurshid Akhmedjanov via UZMOBILE (CIDR: 185.139.138.0/23). The IP presents a moderate risk profile with a score of 40. No open ports or active services were detected. The address is listed on 2 DNSBLs out of 8 total blacklist checks. Control plane analysis indicates route instability.

## Ownership and Geolocation

• Organization: Khurshid Akhmedjanov
• Network Name: UZMOBILE
• ASN: 201767
• Country: Uzbekistan (UZ)
• City: Tashkent
• CIDR Block: 185.139.138.0/23
• RIR: RIPE
• Abuse Contact: Available via RDAP

## Network Behavior Analysis

Service Profile

• Open Ports: None detected
• DNS Resolution: No forward resolution confirmed
• PTR Records: None
• TLS/HTTP Services: No certificates or HTTP titles observed
• Service Purpose: Firewalled / No Services

Control Plane

• Route Stability: False
• Operator Score: 0.1304 (Minimal)
• DNSBL Listings: 2 confirmed, 8 total lists checked
• RPKI State: Not verified
• IRR Consistency: Not verified

## Threat Indicators

• Abuse Confidence Score: Not applicable
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Known Campaigns: None identified
• Threat Observation Count: 0
• Persistently Malicious: No
• Blacklist Count: 0 (threat indicators empty)

## Historical Observation Analysis

Analysis of 11 historical observations reveals:

• Ownership Changes: 0 (stable ownership)
• Threat Persistence: 0 days
• Threat Observation Count: 0
• Last Observed: 2026-07-22
• Observation Confidence: Ranges from 0.30 to 0.95 across signals

The IP has not demonstrated persistent malicious behavior. Recent observations confirm ownership stability with no threat persistence indicators.

## Neighborhood Analysis

The /24 subnet (185.139.138.0/24) contains 16 total sibling IPs:

• Abuse Density: 0.133
• Classification: Clean
• Active Siblings: 3
• Threat Siblings: 0

Notable Neighbor Risk Scores:

Two high-risk neighbors (185.139.138.53, 185.139.138.79) warrant monitoring within the same subnet.

## Relationship Graph

• Total Relationships: 2
• Same Network: UZMOBILE (2 entries)

## Recommended Security Actions

Based on risk assessment, the following defensive measures are recommended:

Firewall Rules

• iptables: `iptables -A INPUT -s 185.139.138.193 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 185.139.138.193 drop`
• nginx: `deny 185.139.138.193;`
• pfSense: `185.139.138.193/32`
• Cloudflare WAF: Block with expression `ip.src eq 185.139.138.193`
• AWS WAF: Add address `185.139.138.193/32`

Additional Recommendations

• Monitor subnet 185.139.138.0/24 for elevated activity patterns
• Flag high-risk neighbors (185.139.138.53, 185.139.138.79) for correlation analysis
• Verify route stability in control plane data before finalizing block decisions

## Intelligence Assessment

The IP address 185.139.138.193 presents a moderate risk profile without active threat indicators. While the subnet shows some elevated activity through neighboring IPs, this specific address demonstrates no persistent malicious behavior. The moderate risk score (40) warrants defensive blocking while maintaining awareness of the subnet's overall risk distribution. Control plane instability should be validated through additional routing data before implementing permanent blocks.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.