104.244.77.208📋 Copy

IP Intelligence Briefing: 104.244.77.208

Date: 2026-06-15

---

**1. Core Profile**

• Risk Score: 59 (Moderate Risk)
• Network Role: Tor Exit Node (confirmed via BGP and DNS)
• Ownership:

- ASN: 53667 (BuyVM)

- RIR: ARIN

- Geolocation: US (California), Roodt (potential placeholder/incorrect city)

• Threat Indicators:

- Identified as a Tor exit node (1/1 threat feeds)

- No known attacker/spam source, low abuse confidence

---

**2. Observation History**

• Latest Signals (2026-06-15):

- Basic network metrics (DNSSEC, CAA, BGP) scored 0.55.

- Geolocation validation failed (ICMP blocked, no RTT data).

• Historical Trends (2026-06-10):

- No significant changes; consistent Tor exit node classification.

- No spikes in threat activity or network anomalies.

---

**3. Relationships & Context**

• Linked Entities:

- BuyVM (ASN 53667, ARIN-registered)

- DNS Hostname: `tor-exit-02.for-privacy.net` (for-privacy.net domain)

• Network Affiliation:

- Subnet: `104.244.77.0/24` (BuyVM-Luxembourg network)

- No other subnets or organizations tied to this IP.

---

**4. Neighborhood Analysis**

• Subnet: `104.244.77.208/24`
• Neighbor Data:

- No neighboring IPs found (likely due to /32 prefix).

- Subnet abuse density: 0% (no malicious activity detected).

---

**5. Key Takeaways for SOC**

• Monitor Tor Traffic: This IP is a Tor exit node, which can mask malicious activity. Investigate traffic routed through this node for potential command-and-control or data exfiltration.
• Verify Ownership: BuyVM is a VPS provider; check if they have known abuse incidents or security advisories.
• DNS Monitoring: Track `tor-exit-02.for-privacy.net` for changes in DNS records or associated domains.
• Geolocation Uncertainty: The IP’s location is unclear due to ICMP blocking. Consider alternative geolocation methods or probe routing paths.

Recommended Actions:

• Add to watchlist for Tor exit node activity.
• Correlate with other Tor exit nodes in BuyVM’s network.
• Validate DNS records for `tor-exit-02.for-privacy.net` for potential phishing or spoofing.

---

Source: IPDebrief Threat Intelligence Platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.