107.189.14.4📋 Copy

IP Intelligence Briefing: 107.189.14.4

Date: 2026-06-15

---

**1. Core Profile**

• Risk Score: 59 (Moderate Risk)
• Provider: Tor Exit Node (ASN 53667, FranTech Solutions)
• Geolocation:

- Country: US (claimed), but geolocation data suggests Luxembourg with a 2500km accuracy radius.

- Region/City: Luxembourg (discrepancy noted).

• Threat Indicators:

- Tor exit node activity observed.

- 1 DNSBL listing (potential abuse).

• Network Role:

- Classified as a Tor exit node with no active services or hosting.

- BGP origin ASN: 53667 (FranTech Solutions).

---

**2. Observation History**

• Recent Activity:

- Consistent observations since 2026-06-14.

- Risk score remains stable at 59.

- No significant changes in geolocation or threat signals.

• Key Trends:

- No spikes in malicious activity or network instability.

- Low subnet abuse density (1/24 subnet).

---

**3. Relationships & Network Context**

• Linked Entities:

- Subnet: 107.189.14.4/24 (abuse density: 1/24).

- Associated with PONYNET-11 network (repeated in relationships).

• Neighbors:

- 107.189.14.43: Risk score 59 (similar to target).

- 107.189.14.106: Risk score 0 (low risk).

• Subnet Classification: "Mostly clean" with 2 active siblings (1 flagged).

---

**4. Threat & Risk Analysis**

• Tor Exit Node:

- High risk for covert malicious activity (e.g., C2, data exfiltration).

- Geolocation discrepancy raises suspicion of spoofing or misconfigured infrastructure.

• DNS & BGP:

- DNSSEC valid, but PTR hostname points to a Tor relay (`Quetzalcoatl-relays.org`).

- BGP route stable (no recent changes).

---

**5. Recommended Actions**

1. Monitor Traffic:

- Scrutinize traffic originating from this IP, especially outbound connections to known malicious domains.

2. Block Tor Exit Nodes:

- Add to firewall rules (e.g., iptables, Cloudflare WAF) to block Tor exit traffic.

3. Verify Geolocation:

- Investigate the Luxembourg geolocation anomaly to rule out spoofing.

4. Subnet Review:

- Assess the 107.189.14.4/24 subnet for potential collateral risk from neighboring IPs.

---

Conclusion:

This IP is a Tor exit node with moderate risk, primarily due to its association with Tor infrastructure. While no direct malicious activity is observed, its role as a Tor exit node necessitates heightened monitoring. The geolocation discrepancy and subnet abuse density suggest further investigation is warranted.

Tools Used: `ipdebrief_profile`, `ipdebrief_history`, `ipdebrief_relationships`, `ipdebrief_neighbors`.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.