103.109.100.148📋 Copy

## THREAT INTELLIGENCE BRIEFING

Target: 103.109.100.148/32

Date: 2026-08-01

Classification: Moderate Risk (Score: 59/100)

EXECUTIVE SUMMARY

IP address 103.109.100.148 is a Tor exit node operated by Amarutu Technology Ltd (AMARUTU-AP) in Hong Kong. The address demonstrates moderate risk characteristics with active blacklist listings and Tor exit node indicators.

TECHNICAL PROFILE

THREAT INDICATORS

• Tor Exit Node: Confirmed (isTor: true)
• Blacklist Status: Listed on 1 blacklist with high severity
• DNSBL Listings: 0 lists (contradicts blacklist count)
• Abuse Confidence: Moderate risk profile
• Campaign Correlation: No known campaign matches

NETWORK SERVICES

TLS Certificate Analysis:

• Issuer: CN=www.zqz4s5r25s5.com
• Subject: CN=www.xcjpyj7pdu56.net
• Status: Self-signed certificate with suspicious domain naming patterns

OBSERVATION HISTORY

• Total Observations: 45 signals recorded
• Recent Activity: Multiple blacklist listings observed on 2026-08-01
• Listings Count: 8 total, 1 currently listed with high severity
• Risk Trend: Persistent blacklist presence indicates sustained malicious activity

NETWORK CONTEXT

Subnet Analysis (103.109.100.0/24):

• Abuse Density: 1 (elevated)
• Total Siblings: 2
• Active Siblings: 2
• Threat Siblings: 2
• Classification: Mostly clean with inherited risk score of 5

Related IP: 103.109.100.162 (Risk Score: 59, Authority Score: 50)

BGP ROUTING

• Origin ASN: 206264
• BGP Prefix: 103.109.100.0/22
• AS Path: 6939 → 206264
• Route Stability: Stable

RECOMMENDED ACTIONS

Immediate:

1. Block at perimeter: Implement iptables/nftables rule to deny inbound traffic on ports 22, 80, 443

2. Monitor egress: Block outbound connections from internal hosts to 103.109.100.0/24

Firewall Rules:

```

# Block Tor exit node

iptables -A INPUT -s 103.109.100.0/24 -j DROP

nft add rule inet filter input ip saddr 103.109.100.0/24 drop

```

Long-term:

1. Block entire subnet: 103.109.100.0/24 shows elevated abuse density

2. Monitor certificate traffic: Suspicious self-signed certificate patterns

3. Correlate with other Tor nodes: Block associated IPs in same /24 range

INTELLIGENCE NOTES

The target IP represents a known Tor exit node infrastructure. Tor exit nodes are commonly abused for:

• Malware distribution
• Command and control communications
• Spam and phishing campaigns
• C2 server masking

The presence of self-signed TLS certificates with obfuscated domain names (zqz4s5r25s5.com, xcjpyj7pdu56.net) suggests potential C2 infrastructure masquerading as legitimate web services.

Priority: MEDIUM

Action Required: YES - Block at perimeter and monitor egress

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.