167.250.202.30📋 Copy

# IP INTELLIGENCE BRIEFING: 167.250.202.30/32

Classification: Low Risk (Residential Infrastructure)

Risk Score: 25/100

Report Date: 2026-07-30

---

## Executive Summary

IP address 167.250.202.30 belongs to UNICONNECT SERVICOS DE TELECOMUNICACOES LTDA (ASN 265226) in Manaus, Brazil. The IP is classified as residential infrastructure with a low-risk profile (score: 25). No active malicious campaigns or known attacker indicators were observed. The IP shows minor DNSBL presence (1 of 8 total lists) and exhibits normal residential service patterns.

---

## Ownership & Geolocation

---

## Network Services & Port Exposure

Active Open Ports:

• TCP/22 (SSH): SSH-2.0-OpenSSH_8.4 (standard residential SSH)
• TCP/8080 (HTTP-alt): Web proxy/alternative HTTP service

DNS Configuration:

• PTR Record: 30-202-250-167.uniconnect.net.br
• Forward Resolution: Confirmed (net.br domain)
• Email Authentication: SPF/DMARC not configured

---

## Threat Indicators

Control Plane:

• BGP Prefix: 167.250.202.0/24
• DNSSEC Valid: Yes
• Route Changes (30d): 0
• DNSBL Listed: Yes (1 listing)

---

## Neighborhood Analysis

Subnet: 167.250.202.0/24

Abuse Density: 0 (Clean classification)

Active Siblings: 0

Threat Siblings: 0

No neighboring IPs within the /24 subnet exhibited malicious activity or threat indicators.

---

## Relationship Graph

---

## Observation History (17 Signals)

Recent Observations (2026-07-30):

• Geolocation: Inferred coordinates (-14.24, -51.93) with 52% confidence; origin data indicates Manaus, BR
• ASN Attribution: AS265226 with threat pulse indicators (4 pulses)
• Port Scan: Detected scanning activity on multiple ports
• DNS Resolution: Resolves to net.br domain
• Blacklist Status: 1 high-severity listing observed

---

## Risk Assessment

Positive Indicators:

• Low risk score (25/100)
• Residential classification (not infrastructure abuse)
• No known attacker indicators
• Clean subnet classification
• No active threat campaigns

Negative Indicators:

• Minor DNSBL presence (1 listing)
• Geographic data inconsistencies in signal history
• High-severity blacklist listing noted
• SSH service exposed without additional hardening data

---

## Recommended Actions

Current Recommendations: None (probabilistic recommendations are empty)

SOC Analyst Considerations:

1. The IP presents as low-risk residential infrastructure with no active malicious activity

2. Monitor for escalation in threat indicators given minor DNSBL presence

3. No immediate firewall blocking required; allow-listing may be considered based on legitimate business needs

4. Continue passive monitoring for changes in service patterns or blacklist status

---

Source: IPDebrief Intelligence Platform

Data Confidence: Moderate (based on 17 historical observations)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.