107.189.10.175📋 Copy

# IP Intelligence Briefing: 107.189.10.175/32

## Executive Summary

Target IP 107.189.10.175 is a confirmed Tor exit node operated by BuyVM (ASN 53667). The IP exhibits moderate risk (score: 59) with one DNSBL listing and Tor exit node indicators. No active services are detected; the IP is firewall-configured with no open ports. The IP belongs to the 107.189.10.0/24 subnet, which shows low abuse density (0.0) and three neighboring IPs with low-risk profiles.

## Ownership and Network Classification

• Organization: BuyVM
• ASN: 53667
• Network: BUYVM-LUXEMBOURG-03
• Geolocation: US (Mersch region, 2500 km accuracy radius)
• Network Role: Tor Exit Nodes
• Infrastructure Type: Unknown

## Threat Indicators

• Risk Score: 59 (Moderate Risk)
• Tor Exit Node: Confirmed (isTorExit: true)
• Blacklist Count: 1
• DNSBL Listed: Yes (1 of 8 total lists)
• Abuse Confidence Score: Not provided

## DNS and Reverse Resolution

• PTR Hostname: LuxembourgTorNew25.Quetzalcoatl-relays.org
• Forward Resolution: LuxembourgTorNew25.Quetzalcoatl-relays.org
• Domain: Quetzalcoatl-relays.org
• Forward Confirmed: No

## Service and Port Analysis

• Open Ports: None detected
• HTTP Services: None
• TLS Certificates: None
• Status: Firewalled / No Services

## Neighborhood Analysis (107.189.10.0/24)

• Subnet Abuse Density: 0.5
• Classification: Mostly Clean
• Total Siblings: 4
• Active Siblings: 3
• Threat Siblings: 2
• Inherited Risk Score: 5
• Neighbor Risk Distribution: 0 High, 0 Medium, 3 Low

Neighbor IPs:

## Observation History

• Total Observations: 55
• Recent Activity: June 19-20, 2026
• Operator Score: Consistent at 0.2609
• Network Classification: Consistently identified as "Tor Exit Nodes"
• Threat Persistence: 0 days
• Ownership Changes: 0
• Persistence Assessment: Not persistently malicious

## BGP and Control Plane

• Origin ASN: 53667
• BGP Prefix: 107.189.8.0/22
• AS Path: 6939 → 53667
• Route Stability: Stable (0 route changes in 30 days)
• RPKI State: Not provided
• DNSSEC Valid: Yes
• Hop Count: 14

## SOC Recommendations

1. Monitor for C2 Traffic: As a Tor exit node, this IP may be used for command-and-control communications or anonymized traffic. Monitor outbound connections from internal systems to this IP.

2. Firewall Rule Consideration: Block inbound connections to this IP. Outbound connections may be permitted depending on security policy.

3. Contextual Analysis: If this IP appears in logs, correlate with destination ports and payload data to determine legitimate use (e.g., legitimate Tor relay traffic vs. malicious C2).

4. Neighborhood Context: The 107.189.10.0/24 subnet shows low abuse density with three low-risk neighbors, suggesting the IP's risk is isolated to its Tor function rather than broader subnet compromise.

5. Threat Intelligence Integration: Add to Tor exit node watchlist for potential abuse detection.

## Risk Assessment

The IP presents moderate risk primarily due to its function as a Tor exit node. The absence of open services reduces the likelihood of direct exploitation. The consistent network classification and stable BGP routing indicate this is an operational Tor node rather than a compromised infrastructure. SOC teams should focus on monitoring outbound traffic patterns and correlating with threat intelligence feeds for Tor-based attacks.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.