107.189.5.249📋 Copy

INTELLIGENCE BRIEFING: 107.189.5.249/32

Executive Summary

IP address 107.189.5.249 presents moderate risk (score: 59/100) with confirmed Tor exit node characteristics. The IP belongs to BuyVM (ASN: 53667) with infrastructure registered in Luxembourg. Historical observation data indicates consistent routing patterns over the analysis period. The address should be treated with heightened scrutiny due to anonymized traffic patterns and elevated neighborhood abuse density.

Risk Profile

• Overall Risk Score: 59/100 (Moderate Risk)
• Network Classification: Tor Exit Nodes
• Geolocation: US (reported), Luxembourg (technical)
• Organization: BuyVM, ASN 53667
• Reputation: Moderate risk with 1 blacklist listing

Threat Indicators

Tor exit indicators observed. The IP functions as a Tor exit node, meaning all traffic from this address passes through the Tor anonymity network. Forward DNS resolves to tor-exit.hackb4.2mpd.com with one blacklist listing recorded. TLS certificates show mismatched issuer and subject fields (issuer: CN=www.63zr3x7hmjaz.com, subject: CN=www.ai4xk3p2dj47sbp67l.net), suggesting potential misconfiguration or abuse.

Network Infrastructure

Active services include HTTP (port 80), HTTPS (port 443), SSH (port 22), HTTP-alt (port 8080), and HTTPS-alt (port 8443). Control plane data indicates stable BGP routing via origin ASN 53667 with route stability confirmed. The IP operates within the 107.189.0.0/21 prefix with established peering relationships through ASN 6939.

Neighborhood Analysis

The /24 subnet (107.189.5.0/24) exhibits high abuse classification with 71.43% abuse density. Six neighboring IPs were analyzed, all showing medium risk scores (40-59). Five threat siblings identified within the subnet. Notable neighbors include 107.189.5.7 (risk: 59) and 107.189.5.121 (risk: 59), both with authority scores of 50.

Temporal Analysis

Sixty-two historical observations recorded since the last measurement period. Operator score remained consistent at 0.2609 across all observations. Route stability maintained with zero route changes in the 30-day window. No ownership changes detected. The IP is not persistently malicious with zero threat persistence days.

Relationship Graph

363 relationship connections identified, with multiple entries mapping to network "BUYVM-LUXEMBOURG-02". High interconnectivity within the BuyVM network infrastructure observed.

Recommended Security Actions

• Implement enhanced verification protocols for anonymous traffic sources
• Increase logging verbosity for activity from this IP
• Consider blocking at perimeter firewall (firewall rules available for iptables, nftables, nginx, pfSense, Cloudflare WAF, and AWS WAF)

Conclusion

107.189.5.249 operates as a Tor exit node within a high-abuse subnet. While not flagged as a known attacker or spam source, the Tor exit node classification necessitates defensive controls. The IP should be blocked or subjected to enhanced monitoring based on organizational risk tolerance for anonymized traffic.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.