5.167.64.98📋 Copy

# IP INTELLIGENCE BRIEFING

IP Address: 5.167.64.98

Classification: Residential Endpoint

Report Date: 2026-06-24

---

## EXECUTIVE SUMMARY

IP 5.167.64.98 is a residential endpoint associated with ER-Telecom Holding (Cheboksary branch, Russia). The IP carries a risk score of 49 (Moderate Risk) and is flagged as a known attacker on threat feeds including blocklist.de. The IP belongs to subnet 5.167.64.0/22, which exhibits high abuse density (0.6094) with 156 out of 256 active siblings flagged as threats.

---

## OWNERSHIP & GEOLOCATION

• Organization: Network Operation Center CJSC ER-Telecom Holding Cheboksary branch
• ASN: 57026
• RIR: RIPE
• Location: Cheboksary, Chuvash Republic, Russia
• CIDR Block: 5.167.64.0/22
• Network Classification: Residential PPPoE endpoint

---

## THREAT INDICATORS

---

## NETWORK CONTEXT

Subnet Analysis (5.167.64.0/24):

• Abuse Density: 0.6094 (High)
• Active Siblings: 219 of 256
• Threat Siblings: 156
• Risk Distribution: 40% Medium, 60% Low

BGP Routing:

• Origin ASN: 57026
• BGP Prefix: 5.167.64.0/22
• Route Stability: Stable (no changes in 30 days)
• RPKI State: Validated

---

## OBSERVATION HISTORY

Total Observations: 52 signals over monitoring period

• Recent Activity: Multiple observations (2026-06-24) showing "Minimal" routing signals
• Threat Persistence: 0 days (transient threat behavior)
• Pattern: No escalating threat trends observed

---

## RELATED ENTITIES

Network Relationships:

• Primary network: ERTH-CHEB-PPPOE-22-NET
• DNS Hostname: 5x167x64x98.dynamic.cheb.ertelecom.ru
• Total Relationships: 294 (primarily internal network associations)

---

## RECOMMENDED ACTIONS

Priority: HIGH

1. Network Edge: Block or rate-limit this IP at the perimeter

2. DNS: No additional DNS-based actions required (forward resolution confirmed)

3. Monitoring: Track for continued activity given high-subnet abuse density

Recommended Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 5.167.64.98 -j DROP

# nftables

nft add rule inet filter input ip saddr 5.167.64.98 drop

# Cloudflare WAF

action: block

filter: ip.src eq 5.167.64.98

```

---

## INTELLIGENCE JUDGMENT

This IP represents a moderate-risk residential endpoint operating within a high-abuse-density subnet. While not exhibiting persistent malicious behavior, the presence on threat feeds and the subnet's abuse profile warrant defensive blocking. The IP appears to be used for legitimate residential purposes but has been associated with attacker activity on threat intelligence platforms.

Recommended Handling: Block with monitoring for 30 days to assess if IP recovers to benign status.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.