188.113.201.97📋 Copy

## INTELLIGENCE BRIEFING: IP 188.113.201.97/32

Classification: High Risk (Risk Score: 80/100) | Geolocation: Uzbekistan (Tashkent) | Organization: Artur Galiullin (NET-COSCOM-2, ASN 49273)

Executive Summary

IP address 188.113.201.97 presents a high-risk profile (80/100) but demonstrates minimal current threat activity. The address is geolocated to Tashkent, Uzbekistan, and operates within a relatively clean subnet environment with low abuse density. Despite the elevated risk classification, the IP shows no open services, no hosted domains, and zero known blacklist entries.

Risk Assessment

• Overall Risk Score: 80 (High Risk)
• Provider/Authority Scores: 0 (no hosting infrastructure identified)
• Operator Score: 0.1304 (Minimal)
• DNSBL Listings: 4 of 8 total lists flagged
• Route Stability: Unstable (route changes detected in 30-day window)

Network Characteristics

• Network Block: 188.113.192.0/19
• Netname: NET-COSCOM-2
• Ownership: Artur Galiullin (RIR: RIPE)
• Geolocation: 41.26°N, 69.22°E (Tashkent, Uzbekistan)
• Services: None detected (firewalled/no services)
• DNS Resolution: No PTR records, no forward resolution, zero hosted domains

Neighborhood Analysis (188.113.201.0/24)

• Abuse Density: 0 (clean)
• Total Siblings: 2
• Active Siblings: 1
• Threat Siblings: 0
• Notable Neighbor: 188.113.201.133 (Risk: 40, Authority: 50)

Threat Indicators

• Known Campaigns: None identified
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0
• Honeypot Hits: 0
• Enumeration Strikes: 0

Historical Observations (12 signals recorded)

Recent monitoring shows consistent classification as "clean" with inherited risk of 0. Geolocation validation remains plausible for Tashkent coordinates. Operator score maintains minimal classification. No evidence of persistent malicious behavior or ownership changes.

Intelligence Narrative

The IP 188.113.201.97 is a residential/small business endpoint in Uzbekistan with no active services. The high risk score (80) appears to stem from DNSBL listings (4/8) rather than active threat indicators. The subnet demonstrates low abuse density with one neighboring IP (188.113.201.133) showing moderate risk (40/100). Route instability suggests possible peering or upstream changes. No evidence of malicious activity, scanning, or campaign participation.

Recommended Actions

• Monitor: Track route stability and DNSBL listing changes
• Block: No immediate action required; risk appears historical
• Investigate: Verify ownership context if traffic originates from this IP
• Context: Evaluate the significance of the 4 DNSBL listings given the clean subnet classification

---

*Intelligence generated from IPDebrief analysis. Data current as of observation timestamp.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.