213.230.93.108📋 Copy

# IP Intelligence Briefing: 213.230.93.108

## Executive Summary

IP address 213.230.93.108 is registered to UZTELECOM (AS8193) and located in Tashkent, Uzbekistan. The address carries a risk score of 80 (High Risk) and is listed on 7 DNS blacklists. While the IP itself shows no active threat indicators, the surrounding subnet demonstrates elevated abuse activity requiring defensive attention.

---

## Network Profile

• IP Address: 213.230.93.108/32
• Organization: AS8193-MNT / UZTELECOM
• Country: Uzbekistan (UZ)
• Region: Tashkent
• CIDR Block: 213.230.93.0/24
• Reputation: High Risk
• Risk Score: 80/100

## Technical Characteristics

• Service Status: Firewalled / No Services Detected
• DNS PTR Record: 108.64.uzpak.uz
• Forward Resolution: Confirmed (1 hostname)
• Open Ports: None detected
• TLS Certificates: Not present
• Route Stability: Unstable (0 route changes in 30 days)
• RPKI State: Not validated

## Threat Indicators

• DNSBL Listings: 7 of 8 total blacklists
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Campaign Matches: 0
• Abuse Confidence Score: Not available

## Geographic Intelligence

Multiple geo-location observations confirm Uzbekistan origin with coordinates centered on Tashkent region (41.26°N, 69.22°E). Recent signals indicate varying geo-location data points including Nukus region, suggesting possible spoofing or inconsistent reporting sources.

## Subnet Neighborhood Analysis

The /24 subnet (213.230.93.0/24) shows moderate abuse concentration:

• Abuse Density: 0.2 (elevated)
• Total Neighbors: 15
• Risk Distribution: 3 High Risk, 12 Medium Risk, 0 Low Risk
• Notable High-Risk Neighbors: 213.230.93.95, 213.230.93.102, 213.230.93.165 (all scoring 80/100)

## Relationship Graph

• Network Association: UZTELECOM (multiple entries)
• DNS Associations: 108.64.uzpak.uz (6 association entries)
• No certificate or organizational relationships detected

---

## Recommended Actions

Immediate Mitigation

1. Block at Network Perimeter: Implement egress/ingress firewall rules to deny traffic from 213.230.93.0/24 subnet

2. DNS Sinkholing: Consider sinkhole for 108.64.uzpak.uz hostname if resolution attempts occur

3. IDS/IPS Rules: Deploy signatures for traffic patterns matching this subnet's profile

Monitoring Recommendations

1. Subnet Surveillance: Monitor all 15 sibling IPs in 213.230.93.0/24 for coordinated activity

2. DNS Monitoring: Track DNS queries to uzpak.uz domain for potential C2 or infrastructure use

3. Threat Intelligence Feeds: Add to watchlist due to 7/8 DNSBL listings and risk score of 80

Escalation Criteria

• Immediate escalation if traffic originates from any of the 3 high-risk neighbor IPs (213.230.93.95, .102, .165)
• Escalate to threat hunting if any new threat indicators appear on this subnet
• Update intelligence if geo-location shifts to known malicious jurisdictions

---

## Intelligence Assessment

This IP represents a defensive priority due to its high risk score and extensive blacklist presence, though no active threat indicators are currently observable. The subnet's abuse density warrants ongoing monitoring. The lack of open services suggests this may be part of bulk hosting infrastructure potentially repurposed for abuse. Recommend maintaining blocklist entries and monitoring for emergence of active scanning or connection attempts.

Classification: Defensive Priority - Monitor

Last Updated: 2026-07-31

Confidence Level: High

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.