104.219.232.218📋 Copy

# IP Intelligence Briefing: 104.219.232.218

## Executive Summary

IP address 104.219.232.218 was classified as a Tor exit node with moderate risk score (59/100). The IP belongs to DataWagon LLC (ASN 27176) and operates a web server infrastructure with standard HTTP/HTTPS/SSH services. Intelligence indicates active Tor exit node behavior with blacklist presence on one of eight DNSBLs.

## Technical Profile

Network Ownership & Registration:

• Organization: DataWagon LLC
• ASN: 27176
• Network Block: 104.219.232.0/21
• RIR: ARIN (allocated 2014-10-31)
• Abuse Contact: Available via RDAP

Geolocation:

• Country: United States
• Region: NY
• Coordinates: 43.3, -74.97
• Timezone: America/New_York
• Geo-plausibility: False (RTT anomaly detected)

Network Classification:

• Primary Role: Tor Exit Nodes
• Connection Type: Web Server
• Infrastructure: Cloud/CDN/VPN/Proxy: No

Observed Services:

• Port 80/TCP: HTTP
• Port 443/TCP: HTTPS
• Port 22/TCP: SSH (OpenSSH_10.0p2 Debian)

DNS Analysis:

• PTR Hostname: high-water-marks.com
• Forward Resolution: Unconfirmed (forwardConfirmed: false)
• Email Authentication: No SPF or DMARC records configured
• Certificate Subject: CN=www.46teasgigimjfvirlcd6.net

## Threat Intelligence

Active Threat Indicators:

• Tor exit node behavior confirmed
• Blacklist presence: 1 of 8 DNSBLs listed
• Maximum blacklist severity: High
• Threat observation count: 1
• Campaign correlation: None identified

Temporal Analysis:

• 100 signal observations collected
• Recent activity shows consistent Tor exit node classification
• Ownership stability: No changes recorded
• Threat persistence: Not persistently malicious

## Neighborhood Analysis

Subnet Assessment (104.219.232.0/24):

• Abuse Density: Low (0/256 IPs flagged)
• Classification: Mostly clean
• Threat siblings: 1
• Active siblings: 1
• No high-risk neighbors detected

## Recommended Actions

Access Control:

• Consider enhanced verification for anonymous traffic originating from this IP
• Implement rate limiting for Tor exit node traffic patterns

Monitoring:

• Increase logging verbosity for all traffic from 104.219.232.218
• Review recent connection activity for potential abuse

Firewall Recommendations:

```bash

# iptables

iptables -A INPUT -s 104.219.232.218 -j DROP

# nftables

nft add rule inet filter input ip saddr 104.219.232.218 drop

# Nginx

deny 104.219.232.218;

# Cloudflare WAF

ip.src eq 104.219.232.218 → Block

# AWS WAF

Addresses: 104.219.232.218/32 → Block

```

## Risk Assessment

Overall Risk Score: 59/100 (Moderate)

Risk Factors:

• Tor exit node classification presents anonymity layer for potential malicious actors
• Blacklist presence indicates prior abuse history
• Inconsistent forward DNS resolution suggests misconfiguration or potential abuse

Mitigation Priority: HIGH

Given the confirmed Tor exit node status and elevated risk score, this IP should be treated as potentially hostile. Implement blocking or enhanced verification controls based on organizational security policies.

---

*Intel generated from IPDebrief platform data. All findings based on observed signals and threat intelligence feeds.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.