185.163.26.73📋 Copy

IP Intelligence Briefing: 185.163.26.73

Date: 2026-06-13

---

**1. Core Profile**

• Risk Score: 40 (Moderate Risk)
• Ownership:

- ASN: 64466 (Abdulvaat Rustam, UZ)

- Netname: GRPS_NAT-1

- Registration: RIR: RIPE, Country: Uzbekistan

• Geolocation:

- Conflicting data:

- London, GB (2 sources)

- Andijan, UZ (1 source)

- Latitude/Longitude: Unavailable

- Timezone: Europe/London (GB)

• Threat Indicators:

- No indicators of malicious activity (no blacklists, spam, or known attackers).

- DNSSEC valid, no DNSBL listings.

---

**2. Network Behavior**

• Network Role:

- Firewalled / No Services (no open ports, TLS, or HTTP services detected).

- Subnet: 185.163.26.0/24 (abuse density: 0%).

• BGP Analysis:

- Origin ASN: 64466 (Abdulvaat Rustam, UZ).

- Route stability: Unstable (route changes in last 30 days).

• Neighbors:

- Subnet: 185.163.26.0/24 (2 total siblings, 1 active).

- Neighboring IP: 185.163.26.9 (risk score: 0, authority score: 50).

---

**3. Observation History**

• Total Observations: 13 (last 30 days).
• Key Trends:

- Geolocation inconsistencies: Mixed reports of UK vs. Uzbekistan.

- DNSSEC validity: Confirmed (no DNSSEC validation errors).

- Threat signals: No persistent malicious activity (threat observation count: 0).

---

**4. Relationships**

• Linked Entities:

- Same network: GRPS_NAT-1 (ASN 64466).

- No direct links to domains, organizations, or certificates.

---

**5. Recommended Actions**

• Firewall Rules:

- Block IP:

```bash

iptables -A INPUT -s 185.163.26.73 -j DROP

nft add rule inet filter input ip saddr 185.163.26.73 drop

```

- Cloudflare/WAF:

```json

{

"action": "block",

"filter": {

"expression": "ip.src eq 185.163.26.73"

}

}

```

• Monitoring:

- Investigate geolocation discrepancies (UK vs. Uzbekistan).

- Monitor for unexpected network activity or subnet changes.

---

**6. Summary**

• Likely Scenario: The IP is part of a firewalled network with no active services, but conflicting geolocation data raises suspicion. Ownership appears legitimate (Uzbekistan-based), but the moderate risk score and inconsistent location data warrant cautious monitoring. No immediate threat indicators, but the IP’s ambiguous origin suggests further scrutiny.

Next Steps: Validate geolocation sources, monitor for unexpected traffic, and consider blocking based on risk profile.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.