101.99.88.74📋 Copy

# IP Intelligence Briefing: 101.99.88.74/32

Classification: Moderate Risk (59/100) | Last Updated: 2026-07-22

Status: Active Threat Indicators Observed

---

## Executive Summary

IP address 101.99.88.74 is registered to Shinjiru Technology Sdn Bhd (ASN 45839) in Malaysia and operates as a Tor exit node with web server functionality. The IP presents moderate risk (59/100) with active Tor exit node indicators and has been observed on threat intelligence blacklists.

---

## Risk Assessment

---

## Technical Profile

Ownership & Registration:

• ASN: 45839 (Shinjiru Technology Sdn Bhd administrator)
• CIDR Block: 101.99.64.0/19
• Netname: SHINJIRU-MY
• RIR: APNIC

Geolocation:

• Country: Malaysia (MY)
• Coordinates: 4.21°N, 101.98°E
• Timezone: Asia/Kuala_Lumpur
• Accuracy Radius: 400km

Network Role:

• Classification: Tor Exit Node / Web Server
• Infrastructure Type: Unknown

---

## Threat Indicators

Active Signals:

• Tor exit node indicators detected
• Listed on 1 of 8 DNSBL feeds
• Interim blacklist listings observed (high severity, confidence 0.85)
• No known attacker or spam source classification

Services:

• Port 80/TCP: HTTP
• Port 443/TCP: HTTPS
• TLS Certificate: Issuer CN=www.xdruz7b5k5h.com / Subject CN=www.kkdyuriemnlyeve.net

DNS Analysis:

• PTR Hostname: server1.kamon.la
• Domain: kamon.la
• Forward Resolution: Unconfirmed
• SPF/DMARC: Not configured

---

## Temporal Analysis

• Total Observations: 91
• Threat Persistence: Single observation event (0 days)
• Ownership Stability: No changes recorded
• Recent Activity: Multiple blacklist listing events observed on 2026-07-22

---

## Neighborhood Context

Subnet 101.99.88.0/24:

• Abuse Density: 1
• Classification: Mostly clean
• Total Siblings: 1
• Threat Siblings: 1
• Active Siblings: 1

---

## Recommended Actions

Immediate (High Severity)

• Increase logging verbosity for traffic from this IP
• Review recent activity patterns and connection attempts

Access Control (Medium Severity)

• Consider enhanced verification procedures for anonymous traffic
• Evaluate blocking or rate limiting for Tor exit node traffic

Firewall Rules

iptables:

```

iptables -A INPUT -s 101.99.88.74 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 101.99.88.74 drop

```

nginx:

```

deny 101.99.88.74;

```

pfSense:

```

101.99.88.74/32

```

Cloudflare WAF:

```json

{

"description": "Block 101.99.88.74 — IPDebrief risk score 59",

"action": "block",

"filter": {"expression": "ip.src eq 101.99.88.74"}

}

```

AWS WAF:

```json

{

"Addresses": ["101.99.88.74/32"],

"Description": "IPDebrief risk 59"

}

```

---

## Intelligence Assessment

This IP demonstrates characteristics consistent with Tor exit node infrastructure. The elevated risk score (59/100) combined with observed Tor exit node indicators and blacklist presence suggests potential for abuse as an anonymity service endpoint. The subnet shows minimal inherited risk (2/100), indicating this IP is the primary threat vector in its network block.

Recommended SOC Procedure: Monitor for patterns of abuse including C2 beaconing, data exfiltration attempts, or proxy-related activity. Correlate with other Tor exit node indicators in threat feeds.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.