104.244.79.61📋 Copy

IP Intelligence Briefing: 104.244.79.61

Date: 2026-06-09

---

**1. Core Profile**

• Risk Score: 59 (Moderate Risk)
• Network Role: Tor Exit Node (Highly anonymized, potential for misuse)
• Ownership:

- ASN: 53667 (BuyVM)

- Geolocation: Luxembourg, US (geo-plausible, 600km from source)

• Threat Indicators:

- Tor exit node observed (1/12/2026)

- 1/8 DNSBL listings (potential spam/abuse risk)

• Services: No open ports, no TLS certs, no HTTP services

---

**2. Observation History**

• Signal Stability: Stable over 5 days (0 route changes, 0 ownership shifts)
• Risk Trends:

- Consistent "Moderate Risk" classification

- No spikes in threat activity or DNS anomalies

• Geolocation: Consistent Luxembourg origin (RTT: 102–105ms)

---

**3. Network Relationships**

• Subnet: 104.244.79.0/24 (BuyVM)
• Key Relationships:

- Linked to 500+ IPs in the same network (BUYVM-LUXEMBOURG-01)

- 4 neighbors analyzed:

- 104.244.79.40: High risk (80/100), potential abuse

- 104.244.79.44/79.50: Moderate risk (59/100)

- 104.244.79.113: Low risk (0/100)

• Subnet Abuse Density: 0.25 (mostly clean, but includes high-risk peers)

---

**4. Threat Context**

• Tor Exit Node:

- Exit nodes are often used for obfuscating malicious traffic (e.g., C2, data exfiltration).

- 1/8 DNSBL listings suggest potential spam or abuse ties.

• Neighbor Analysis:

- 1/4 neighbors flagged as high risk; monitor for lateral movement or shared infrastructure risks.

---

**5. Recommended Actions**

1. Block/Rate Limit Tor Exit Traffic:

- Use iptables/nftables to block TCP ports 443/80 (common Tor exit traffic).

2. Monitor Neighboring IPs:

- Focus on 104.244.79.40 for potential abuse correlation.

3. Check DNSBL Status:

- Investigate why this IP is listed on 1/8 DNSBLs (e.g., Spamhaus, Project Honey Pot).

4. Geolocation Validation:

- Confirm Luxembourg origin with additional probes if suspicious activity is detected.

---

Summary: This IP is a Tor exit node operated by BuyVM with moderate risk. While it shows no direct malicious activity, its association with high-risk neighbors and Tor infrastructure warrants monitoring for potential misuse.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.