84.54.72.38📋 Copy

# IP Intelligence Briefing: 84.54.72.38/32

## Executive Summary

IP address 84.54.72.38 was analyzed and classified as High Risk (risk score: 70/100). The IP is a residential endpoint originating from Uzbekistan, operating within the UZTELECOM network infrastructure. While no direct threat indicators were observed, the subnet exhibits elevated abuse density with multiple high-risk neighbors, warranting defensive monitoring.

## Network Classification and Ownership

• Organization: Role of Uzbektelecom JSC (UZTELECOM)
• ASN: 8193
• Country: Uzbekistan (UZ)
• City: Tashkent
• Infrastructure Type: Residential
• CIDR Block: 84.54.72.0/24
• DNS PTR: 38.72.albatros.uz

## Risk Profile

The IP was assigned a risk score of 70/100, classified as "High Risk." Key findings include:

• DNSBL Listings: 4 out of 8 total blacklist counts
• Route Stability: Not stable (isRouteStable: false)
• Operator Score: 0.1304 (Minimal)
• Control Plane: No BGP prefix changes in 30-day window
• Threat Indicators: No known campaigns, Tor exit node, known attacker, or spam source flags
• Network Role: Residential endpoint, not cloud, CDN, VPN, proxy, or hosting infrastructure

## Historical Observations

Analysis revealed 14 historical observations recorded. Recent signals from July 30, 2026 confirm consistent geolocation to Tashkent, Uzbekistan. No ownership changes were detected. Threat observation count remained at zero, indicating no persistent malicious activity history. Network role classification as residential was maintained throughout observation period.

## Network Neighborhood Analysis

The /24 subnet (84.54.72.0/24) contains 23 sibling IPs with an abuse density of 0.348. Risk distribution shows:

• High Risk: 8 siblings
• Medium Risk: 13 siblings
• Low Risk: 2 siblings

Multiple neighboring IPs exhibited risk scores of 70-80, suggesting coordinated or related activity within the subnet. Notable high-risk neighbors included 84.54.72.11, 84.54.72.16, 84.54.72.17, 84.54.72.29, 84.54.72.39, 84.54.72.44, 84.54.72.45, 84.54.72.83, 84.54.72.93, 84.54.72.136, 84.54.72.145, 84.54.72.223, and 84.54.72.249.

## Recommended Actions

Based on the risk profile, the following actions are recommended:

Monitoring: Increase logging verbosity and review recent activity from this IP due to elevated risk score (70/100).

Firewall Rules:

• iptables: `iptables -A INPUT -s 84.54.72.38 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 84.54.72.38 drop`
• nginx: `deny 84.54.72.38;`
• pfSense: Block 84.54.72.38/32
• Cloudflare WAF: Block rule for IP 84.54.72.38
• AWS WAF: Block CIDR 84.54.72.38/32

## Intelligence Narrative

IP 84.54.72.38 operates as a residential endpoint within the UZTELECOM network infrastructure in Tashkent, Uzbekistan. While the IP itself showed no direct malicious indicators, the subnet environment presents elevated risk with an abuse density of 0.348 and eight high-risk sibling IPs. The residential nature of the endpoint combined with multiple DNSBL listings and unstable routing suggests potential for legitimate or opportunistic misuse. SOC analysts should monitor traffic patterns from this IP and consider blocking at the perimeter firewall while maintaining correlation with subnet-wide activity. The absence of known threat indicators and campaigns suggests the IP may be engaged in opportunistic scanning or misconfigured service rather than coordinated malicious activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.