185.187.77.36📋 Copy

# IP INTELLIGENCE BRIEFING: 185.187.77.36/32

Date: 2026-07-25

Classification: Low Risk / Monitoring Recommended

Status: Active Investigation

---

## EXECUTIVE SUMMARY

IP address 185.187.77.36 is registered to AS206206 (Kurdistan net company for computer and internet ltd.) under the Kurdistan-net-subnet-31 network block, headquartered in Duhok, Iraq. The IP presents a low-risk profile (Risk Score: 25) with current service status showing "Firewalled / No Services." While no active threat indicators are present, historical signals indicate prior threat observations requiring continued monitoring.

---

## NETWORK IDENTIFICATION

---

## RISK PROFILE

Overall Risk Score: 25 / 100 (Low Risk)

Threat Indicators:

• Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• DNSBL Listings: 1 of 8 total lists
• Honeypot Hits: 0
• Enumeration Strikes: 0

Network Classification:

• Provider/Infrastructure: None
• Connection Type: Firewalled / No Services
• Cloud/CDN/VPN/Proxy: No
• Residential/Hosting: No

---

## GEOSPATIAL ANALYSIS

Location Data:

• Coordinates: 33.0°N, 44.0°E
• Region: Duhok Governorate, Iraq
• Geo Source Consensus: True (1 source)
• Geo Plausibility: False (validation discrepancy noted)

Route Stability:

• BGP Prefix: 185.187.76.0/23
• Route Stability: Unstable
• Operator Score: 0.1304 (Minimal)

---

## HISTORICAL OBSERVATIONS

Signal History (12 Observations):

Recent observations indicate mixed signal characteristics:

• Subnet Classification: Consistently reported as "clean" with 0 abuse density
• Ownership Changes: 0 changes detected (stable ownership)
• Threat Persistence: No persistent malicious activity detected
• Geolocation Signals: Multiple sources confirm Iraq origin
• Threat Feed Alerts: 1 Pulsedive threat signal detected (AlienVault-OTX)

Temporal Analysis:

• Threat Observation Count: 0
• Threat Persistence Days: 0
• Ownership Changes: 0
• Is Persistently Malicious: False

---

## NEIGHBORHOOD ANALYSIS

Subnet: 185.187.77.0/24

Abuse Density: 0 (Clean)

Classification: Clean

Neighbor Distribution (6 active siblings):

• High Risk: 0
• Medium Risk: 0
• Low Risk: 5
• Unknown Risk: 1 (185.187.77.56)

Notable Neighbors:

---

## RELATIONSHIP GRAPH

Direct Relationships (2):

• Kurdistan-net-subnet-31 (Same Network) - Listed twice

No external entity relationships detected (hostnames, certificates, organizations beyond network).

---

## SERVICE ANALYSIS

Open Ports: None detected

TLS Certificate: None

HTTP Banner: None

Hosted Domains: 0

Email Authentication:

• SPF: Not configured
• DMARC: Not configured
• TXT Records: 0

---

## ACTIONABLE RECOMMENDATIONS

For SOC Analysts:

1. Monitor: Continue monitoring this IP for service activation. Current firewall status may change.

2. Contextualize: The IP resides in a geographically complex region (Iraq) with prior threat signals in the neighborhood. Evaluate traffic patterns against known threat intelligence for the Kurdistan region.

3. DNSBL Check: 1 DNSBL listing detected. Verify which list and whether it affects legitimate operations.

4. Geolocation Validation: Geo Plausibility flag is False. Validate actual traffic origin against reported location.

5. Historical Context: 12 observations show the IP has been tracked with varying confidence levels. No persistent malicious behavior confirmed.

Recommended Firewall Rule:

```

# Allow with logging (low risk, no active threats)

iptables -A INPUT -s 185.187.77.36/32 -j LOG --log-prefix "IP-185-187-77-36: "

```

Threat Level: LOW - No immediate blocking required. Monitor for service activation and threat indicator changes.

---

*Report generated using IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.