107.189.13.180📋 Copy

IP Intelligence Briefing: 107.189.13.180

Date: 2026-06-06

---

**1. Core Profile**

• Risk Score: 59 (Moderate Risk)
• Network Role: Tor Exit Node (classified as "Web Server" with HTTP/HTTPS services)
• Ownership:

- ASN: 53667

- Organization: FranTech Solutions

- Geolocation: US (Luxembourg city, 2500km accuracy radius)

• Threat Indicators:

- Tor exit node detected

- 1 blacklist listing (DNSBL)

- No known attacker/spam source

---

**2. Observation History**

• Signal Trends:

- Consistent "Basic" risk classification (operator score: 0.26)

- Tor exit indicators observed in 49 total signals over 30 days

- No significant spikes in threat activity or risk scores

• Geo Validation:

- Geo plausibility flag false (discrepancy between reported location and actual network origin)

---

**3. Relationships**

• Network Associations:

- Linked to subnet 107.189.13.0/24 (abuse density: 0.8, classified as "mostly_clean")

- Part of PONYNET-11 network (repeated in 76 relationships)

• Key Entities:

- No direct connections to known malicious organizations or domains

- TLS certificate issuer: `www.i6rman2l73rhexw5m.com` (no known malicious patterns)

---

**4. Neighborhood Analysis**

• Subnet Overview:

- 107.189.13.0/24 contains 5 sibling IPs (4 active)

- Abuse Density: 0.8 (high risk for subnet)

- Neighbor Risk Scores:

- 107.189.13.11: 25 (low)

- 107.189.13.30: 25 (low)

- 107.189.13.253: 59 (moderate)

- 107.189.13.254: 59 (moderate)

• Subnet Classification: "Mostly clean" but with elevated risk due to neighboring IPs.

---

**5. Threat Context**

• Tor Exit Node:

- High anonymity, but potential for misuse (e.g., C2 servers, data exfiltration).

- No direct evidence of malicious activity, but Tor exit nodes are often associated with covert operations.

• Geolocation Discrepancy:

- Reported location (Luxembourg) may not align with actual network infrastructure.

---

**6. Recommendations**

• Monitoring:

- Track traffic from this IP for unusual patterns (e.g., outbound C2, data exfiltration).

- Monitor neighboring IPs (107.189.13.253/254) for potential lateral movement.

• Mitigation:

- Consider blocking Tor exit nodes if not required for legitimate operations.

- Validate geolocation data for discrepancies.

• Investigation:

- Cross-reference with PONYNET-11 network for potential关联 (relationships).

---

End of Briefing

*Generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.