181.115.167.29📋 Copy

## IP Intelligence Briefing: 181.115.167.29

Executive Summary

IP address 181.115.167.29 was classified as Moderate Risk (score: 55/100) during analysis. The address operates as a residential endpoint in Cochabamba, Bolivia, under the infrastructure of EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA (Entel). While no active threat indicators were detected, the risk profile warrants monitoring due to the elevated risk score and residential classification.

Ownership and Infrastructure

The IP address is allocated to ASN 6568 (EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA) within the LACNIC RIR region. Ownership records show the CIDR block 181.115.128.0/17, with abuse contact available via RDAP. The IP resolved to the Cochabamba region with geolocation confidence confirmed through multiple sources.

Threat Profile

Threat analysis returned no active indicators: no blacklist presence, no known attack campaigns, no Tor exit node activity, and no proxy detection. The address scored 0 on threat feeds and maintained zero blacklist count across scanned sources. No DNSBL listings were identified in the control plane data.

Network Classification

The infrastructure type was classified as Residential Endpoint. No cloud, CDN, VPN, proxy, hosting, mobile, or anycast characteristics were detected. The address is not bogon and does not exhibit hosting service attributes.

Service and DNS Analysis

DNS analysis returned no PTR hostnames and zero forward resolution results. No hosted domains or email authentication records (SPF/DMARC) were associated with the address. Service scanning detected no open ports, TLS certificates, HTTP titles, or server banners.

Control Plane Assessment

Control plane analysis showed route stability issues with isRouteStable=false. The BGP prefix 181.115.160.0/20 showed 0 route changes over 30 days. RPKI state remained unverified. The operator score of 0.1304 was labeled as "Minimal" delegation authority.

Observation History

Twelve observations were recorded, with the most recent activity timestamped 2026-07-22. The history indicates stable ownership with zero ownership changes and no persistent malicious activity. Residential classification remained consistent across all observations.

Neighborhood Analysis

The /24 subnet (181.115.167.0/24) contained six total sibling IPs with zero abuse density. Risk distribution showed two medium-risk neighbors (181.115.167.175 and 181.115.167.240, both scoring 55), with no high-risk or clean neighbors detected. One active sibling was observed.

Related Entities

Relationship graph analysis identified two connections, both linking to the parent network range 181.115.128.0 - 181.115.255.255. No additional organizational, hostname, or certificate relationships were discovered.

Recommended Actions

Based on the risk profile, the following security measures are recommended:

1. Monitoring: Increase logging verbosity and review recent activity from this IP address due to the elevated risk score of 55/100.

2. Firewall Rules: Implement blocking rules across platforms:

- iptables: `iptables -A INPUT -s 181.115.167.29 -j DROP`

- nftables: `nft add rule inet filter input ip saddr 181.115.167.29 drop`

- nginx: `deny 181.115.167.29;`

- pfSense: `181.115.167.29/32`

- Cloudflare WAF: Block with expression `ip.src eq 181.115.167.29`

- AWS WAF: Add 181.115.167.29/32 to IP set

Intelligence Assessment

The IP address presents moderate risk due to elevated scoring in residential networks, which are frequently associated with compromised endpoints. No direct threat activity was observed, but the neighborhood risk distribution indicates potential correlation with other medium-risk addresses in the same subnet. SOC teams should monitor for activity patterns and consider correlation analysis with neighboring IPs.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.