103.109.100.162
## Intelligence Briefing: 103.109.100.162/32
Date: Current
Analyst: IPDebrief Intelligence Team
Classification: Moderate Risk
---
Executive Summary
IP address 103.109.100.162 is a Tor exit node hosted in Hong Kong, associated with Amarutu Technology Ltd (ASN 206264). The IP exhibits Tor exit indicators and has been listed on 1 blacklist with high severity ratings. Risk score is 59/100. Immediate review recommended for all traffic originating from this address.
---
Technical Profile
Network Identity:
- IP: 103.109.100.162/32
- ASN: 206264 (Amarutu Technology Ltd)
- Organization: AMARUTU-AP
- CIDR Block: 103.109.100.0/22
- RIR: APNIC
- Location: Hong Kong, HK (22.4°N, 114.11°E)
Network Classification: Tor Exit Node / Web Server
Open Ports:
- TCP/80 (HTTP)
- TCP/443 (HTTPS)
- TCP/22 (SSH - OpenSSH_10.0p2 Debian)
DNS Resolution:
- PTR Record: server.rarechems.com
- Forward Resolution: server.rarechems.com (unconfirmed)
- TLS Certificate: Self-signed chain with issuer CN=www.gaukxoq6ic5jjf.com, subject CN=www.cmhtomdfpg.net
- No SPF or DMARC records configured
---
Threat Indicators
Primary Indicators:
- Tor Exit Node Activity: Confirmed Tor exit indicators observed
- Blacklist Status: Listed on 1 DNSBL (high severity)
- Abuse Confidence: Not classified as known attacker or spam source
Historical Activity:
- Total observations: 72 signals
- Recent blacklist activity observed on August 10, 2026 (multiple high-severity entries)
- Risk score elevated from baseline due to Tor association
---
Neighborhood Analysis
Subnet: 103.109.100.162/24
- Abuse Density: 0 (mostly clean)
- Total Siblings: 2 active
- Threat Siblings: 2
- Neighbor Risk: One sibling IP (103.109.100.148) shows risk score of 59
Control Plane:
- Origin ASN: 206264
- BGP Prefix: 103.109.100.0/22
- AS Path: 6939 → 206264
- Route Stability: Unstable (1 route change in 30 days)
- RPKI State: Not evaluated
- DNSSEC: Valid
---
Recommended Actions
Access Control:
- Consider enhanced verification for anonymous traffic
- Implement traffic filtering rules for this IP
Monitoring:
- Increase logging verbosity for all traffic from this source
- Review recent activity patterns for anomalies
Firewall/Blocking Rules:
| Platform | Rule |
|---|---|
| iptables | `iptables -A INPUT -s 103.109.100.162 -j DROP` |
| nftables | `nft add rule inet filter input ip saddr 103.109.100.162 drop` |
| nginx | `deny 103.109.100.162;` |
| pfSense | Add rule for 103.109.100.162/32 |
| Cloudflare WAF | Block IP via expression filter |
| AWS WAF | Add IP to block list (CIDR: 103.109.100.162/32) |
---
Intelligence Assessment
This IP represents a known Tor exit node infrastructure, which is commonly exploited for anonymous malicious communications, credential harvesting, and command-and-control activities. While the IP itself is not flagged as a known attacker, its association with Tor exit node functionality combined with blacklist listings warrants defensive treatment.
The subnet shows minimal inherited risk but contains multiple threat siblings. The route instability suggests potential infrastructure churn, which is common among Tor exit node providers.
Recommendation: Treat traffic from this IP as untrusted until verified. Implement blocking or rate-limiting policies based on organizational risk tolerance. Monitor for any changes in behavior patterns.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Amarutu Technology Ltd administrator |
| ASN | AS206264 |
| Network Name | AMARUTU-AP |
| CIDR Block | 103.109.100.0/22 |
| RIR | APNIC |
| Country | HK |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | server.rarechems.com |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | server.rarechems.com |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| 22 | ssh | tcp | Banner detected |
| Closed Ports | 25, 3389, 8080, 8443 (3 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | 2026-07-28T00:00:00+00:00 |
| Valid Until | 2026-11-14T23:59:59+00:00 |
🛡️ Public Network Snapshot
| Origin ASN | AS206264 |
| Network Prefix | 103.109.100.0/22 |
| Route mapping | Found |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 60% | 2 | 25 |
| routing | 32% | 2 | 3 |
| services | 35% | 2 | 3 |
| ownership | 40% | 3 | 5 |
| reputation | 26% | 1 | 3 |
| geolocation | 32% | 2 | 3 |
| Overall | 38% | 12 | 42 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-11 12:58:19 UTC |
| Last Seen | 2026-09-02 14:17:59 UTC |
| Profile Built | 2026-09-02 14:30:49 UTC |
| Data Freshness | Live |
| Signal Types | 31 |
| Total Observations | 42 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 103.109.100.162
Who owns the IP address 103.109.100.162?
103.109.100.162 is registered to Amarutu Technology Ltd administrator. The address falls within the 103.109.100.0/22 network block. Registration is held at APNIC.
Where is 103.109.100.162 located?
Geolocation data places 103.109.100.162 in Quarry Bay, Eastern, Hong Kong. The local time zone is Asia/Hong_Kong. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 103.109.100.162 malicious or safe?
103.109.100.162 currently carries a moderate risk assessment, meaning some indicators warrant caution, but the evidence is mixed. This assessment is generated from continuously collected signals and can change over time.
What is the hostname for 103.109.100.162?
The reverse DNS (PTR) record for 103.109.100.162 is server.rarechems.com. This hostname is not forward-confirmed, so it should be treated as a weak signal.
What ports are open on 103.109.100.162?
Responsive ports observed on 103.109.100.162 include 80, 443, 22. Port visibility reflects the most recent scan and may change as the host's configuration or firewall rules change.
Is 103.109.100.162 a VPN, proxy, or data center address?
103.109.100.162 is classified as the Tor network based on network ownership and behavioural analysis.