5.167.65.49📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 5.167.65.49/32

Date: 2026-06-24

Risk Level: MODERATE (Score: 40)

---

## EXECUTIVE SUMMARY

IP 5.167.65.49 is a residential endpoint assigned to ER-Telecom Holding's Cheboksary branch in Russia (ASN 57026). The IP resides within a high-abuse density /24 subnet (5.167.65.0/24) containing 124 active residential IPs. Despite the subnet-level abuse classification, this specific IP shows no active threat indicators and maintains a stable "Minimal" risk profile across recent observations.

---

## NETWORK ATTRIBUTES

---

## THREAT ASSESSMENT

• Risk Score: 40 (Moderate)
• Abuse Confidence Score: Not available
• Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Threats: None detected

Control Plane:

• Route Status: Unstable (0 changes in 30 days)
• DNSBL Listed: 1 of 8 lists
• Operator Score: 0.1304 (Minimal)
• RPKI State: Not available

---

## NEIGHBORHOOD ANALYSIS

Subnet: 5.167.65.0/24

• Total Siblings: 256
• Active Siblings: 124
• Abuse Density: High
• Risk Distribution: 96 Medium | 4 Low | 0 High
• Inherited Risk Score: 40

Multiple neighboring IPs (5.167.65.0, 5.167.65.4) show identical risk scores of 25-40, indicating consistent residential assignment across the subnet.

---

## OBSERVATION HISTORY

Recent signal history (past 48 hours) shows consistent "Minimal" risk classifications with operator scores of 0. Five observations recorded:

• 2026-06-24 17:28 UTC: Minimal risk, 0 operator score
• 2026-06-24 11:27 UTC: Minimal risk, 0 operator score
• 2026-06-24 05:19 UTC: Minimal risk, 0 operator score
• 2026-06-23 23:10 UTC: Minimal risk, 0 operator score

No evidence of escalating threat activity or changing classification patterns.

---

## NETWORK RELATIONSHIPS

• Primary Network: ERTH-CHEB-PPPOE-22-NET (297+ related entries)
• Relationship Type: Same Network (PPPOE residential block)
• Correlated IPs: 0 confirmed malicious correlations

---

## SERVICES & OPEN PORTS

• Open Ports: None detected
• HTTPS/TLS: None detected
• HTTP Banner: None detected
• Certificates: None detected

---

## RECOMMENDED ACTIONS

Current Risk: Moderate (40) – No immediate blocking required based on this profile alone.

Firewall Rules (if blocking deemed necessary):

```

iptables: iptables -A INPUT -s 5.167.65.49 -j DROP

nftables: nft add rule inet filter input ip saddr 5.167.65.49 drop

nginx: deny 5.167.65.49;

```

Monitoring Priority: LOW-MEDIUM

• Monitor for service activation
• Track for blacklist additions
• Correlate with observed malicious activity from same subnet

---

## INTELLIGENCE NOTES

• The /24 subnet is classified as high-abuse, but this IP shows no active malicious indicators
• Residential PPPOE assignment suggests legitimate end-user traffic
• DNSBL listing (1 of 8) may indicate historical reputation issues
• Route instability (false) warrants periodic re-verification
• No open services detected; IP appears dormant from network scanning perspective

Conclusion: Monitor but do not proactively block. If incident activity originates from this IP, correlation with other threat signals would be required before taking action.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.