107.189.7.141📋 Copy

IP Intelligence Briefing: 107.189.7.141

Date: 2026-06-09

---

**1. Core Profile**

• Risk Score: 59 (Moderate Risk)
• Network Role: Tor Exit Node (High-risk category)
• Ownership:

- ASN: 53667

- Organization: BuyVM (Hosting provider)

- Geolocation: US (ME, Bissen; geolocation accuracy ±2500 km)

• Threat Indicators:

- Confirmed Tor exit node (1 observed signal)

- Listed in 2 DNSBLs (abuse confidence score unspecified)

- No known attacker or spam source associations

---

**2. Observation History**

• Recent Activity (Last 7 Days):

- Consistent Tor exit node signaling (1 observation).

- Geolocation data shows stable US origin (latitude/longitude unspecified).

- Network stability score: 0.3 (Basic operator risk label).

• Trend: No significant changes in risk or network behavior.

---

**3. Network Relationships**

• Linked Entities:

- Same network: `BUYVM-LUXEMBOURG-02` (repeated 150 times in relationships).

- Subnet: `107.189.7.141/24` (abuse density: 0/10).

• Neighbors:

- 3 sibling IPs in the subnet:

- 107.189.7.144: Risk score 59 (same as target).

- 107.189.7.156: Risk score 25 (low).

- 107.189.7.168: Risk score 59 (same as target).

---

**4. Services & Technical Context**

• Open Ports:

- Port 8443 (HTTPS-alt) open (no banner).

• TLS Certificate:

- Issued to `www.ts5osdxusn5q4o7gxluq.com` (subject: `www.aquviabft7x.net`).

• DNS:

- No PTR records or domain associations.

- DNSSEC validation: Enabled.

---

**5. Threat Assessment**

• Primary Risk: Tor exit node activity (commonly used for anonymized malicious traffic).
• Subnet Context: Low abuse density, but IP is part of a hosting provider network with mixed risk siblings.
• Actionable Indicators:

- Monitor for outbound traffic from this IP.

- Consider blocking Tor exit nodes in firewall rules.

---

**6. Recommendations**

1. Block/monitor traffic from 107.189.7.141 due to Tor exit node association.

2. Investigate BUYVM-LUXEMBOURG-02 subnet for potential infrastructure ties.

3. Track TLS certificate domains (`www.ts5osdxusn5q4o7gxluq.com`, `www.aquviabft7x.net`) for additional threats.

4. Validate geolocation using internal probes, as coordinates are unspecified.

---

Source: IPDebrief threat intelligence platform.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.