167.61.170.63📋 Copy

# IP Intelligence Briefing: 167.61.170.63/32

Classification: Moderate Risk (Score: 40) | Date: 2026-07-24

## Executive Summary

IP address 167.61.170.63 is a residential endpoint located in Montevideo, Uruguay, operated by the national telecommunications provider ANTEL. The IP presents moderate risk with no active threat indicators but maintains a low abuse density profile within its subnet.

## Ownership & Infrastructure

• ASN: 6057
• Organization: Administracion Nacional de Telecomunicaciones (ANTEL)
• Network Block: 167.56.0.0/13
• Infrastructure Type: Residential DSL
• Connection Type: Residential Endpoint
• BGP Prefix: 167.61.160.0/20

## Geolocation

• Country: Uruguay (UY)
• City: Montevideo
• Region: Montevideo Department
• GeoConsensus: Validated across multiple sources

## Threat Assessment

## Network Behavior

• Route Stability: Unstable (route_changes_30d: 0, isRouteStable: false)
• DNSSEC: Valid
• Operator Score: 0.2609 (Basic)
• Open Ports: None detected
• TLS Certificates: None
• HTTP Services: None active

## DNS Intelligence

• PTR Record: r167-61-170-63.dialup.adsl.anteldata.net.uy
• Forward Resolution: Confirmed
• Hosted Domains: 0
• Email Authentication: SPF/DMARC not configured

## Historical Analysis

13 observations recorded over the monitoring period:

• Geolocation: Consistently Montevideo, Uruguay
• Classification: Stable residential designation
• Ownership: No changes detected
• Threat Persistence: 0 days (no persistent malicious activity)

## Neighborhood Analysis

• Subnet: 167.61.170.0/24
• Abuse Density: 0.0
• Neighbor Count: 0
• Threat Siblings: 0
• High-Risk Neighbors: 0

## Related Entities

• Network: 167.56.0.0 - 167.63.255.255
• DNS Hostname: r167-61-170-63.dialup.adsl.anteldata.net.uy

## Recommended Actions

Immediate

The risk score of 40 warrants blocking with standard residential IP filtering:

```bash

# iptables

iptables -A INPUT -s 167.61.170.63 -j DROP

# nftables

nft add rule inet filter input ip saddr 167.61.170.63 drop

# nginx

deny 167.61.170.63;

```

Cloud Platforms

• Cloudflare WAF: Block with expression `ip.src eq 167.61.170.63`
• AWS WAF: Add `167.61.170.63/32` to IP set with description "IPDebrief risk 40"
• pfSense: Add `167.61.170.63/32` to blocklist

## Risk Narrative

This IP represents a legitimate residential connection from Uruguay's national ISP. The moderate risk score (40) reflects standard residential IP risk rather than confirmed malicious activity. No threat indicators, campaigns, or known attacker signatures were identified. The absence of open ports and active services suggests this endpoint is not currently being used for malicious purposes. The IP has been observed consistently with stable geolocation and ownership characteristics.

Recommendation: Apply standard residential IP filtering. Monitor for any behavioral changes indicating escalation to higher-risk activity. No immediate escalation required beyond baseline residential IP handling.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.