107.189.8.133📋 Copy

INTELLIGENCE BRIEFING: 107.189.8.133/32

Classification: Tor Exit Node Infrastructure — Moderate Risk

Date: Current

Analyst: IPDebrief Intelligence

---

EXECUTIVE SUMMARY

IP address 107.189.8.133 is confirmed as a Tor exit node operated by BuyVM (ASN 53667). The IP presents moderate risk (Score: 49) primarily due to Tor exit node classification. No active malicious indicators were observed in recent traffic patterns. The surrounding /24 subnet exhibits high abuse density with 6 additional Tor exit nodes sharing similar risk characteristics (scores 49-55).

---

OWNERSHIP & INFRASTRUCTURE

The IP is part of a larger Tor exit node infrastructure deployed across the 107.189.8.0/24 subnet, with 7 active sibling IPs identified.

---

THREAT INDICATORS

Threat Observations:

• Tor exit node indicators observed in network classification
• DNS forward resolution confirms: `LuxembourgTorNew6.Quetzalcoatl-relays.org`
• PTR hostname matches: `LuxembourgTorNew6.Quetzalcoatl-relays.org`
• No open ports detected (service status: Firewalled / No Services)

---

GEOLOCATION DISCREPANCY

*Note: Geolocation data shows inconsistency between country code (US) and regional data (Luxembourg). This is common with cloud-based Tor infrastructure.*

---

NETWORK NEIGHBORHOOD ANALYSIS

Subnet: 107.189.8.0/24

Sibling Risk Profile:

All neighbors share identical risk profiles consistent with Tor exit node classification.

---

OBSERVATION HISTORY

Analysis Period: 50 observations recorded

Recent observations (June 26-27, 2026) indicate consistent Tor exit node behavior without additional malicious indicators or service changes.

---

CONTROL PLANE ANALYSIS

---

RECOMMENDED ACTIONS

SOC Analyst Guidance:

1. Allow List Evaluation: This IP is a Tor exit node. If your organization permits Tor traffic, monitor for abuse patterns. If blocked, ensure egress filtering is configured.

2. Firewall Rules: No additional blocking required beyond existing Tor exit node policies. Standard Tor exit node mitigation applies.

3. Traffic Monitoring: Monitor for:

- Unusual data exfiltration patterns

- Command and control beaconing

- Large payload transfers through Tor relay

4. Subnet Context: The entire 107.189.8.0/24 subnet should be evaluated with consistent Tor exit node policies. All 7 sibling IPs share the same classification.

5. False Positive Awareness: The moderate risk score (49) is appropriate for Tor exit node classification. Do not treat as malicious without additional context.

---

CONCLUSION

IP 107.189.8.133 is a legitimate Tor exit node infrastructure component operated by BuyVM. The IP presents expected moderate risk consistent with Tor relay classification. No evidence of active malicious activity or abuse beyond standard Tor exit node behavior. The surrounding subnet exhibits consistent Tor infrastructure deployment with no anomalous risk escalation.

Status: Monitor — Standard Tor Exit Node Policy Applies

Priority: Low (Infrastructure Classification)

Action: No immediate changes required; maintain existing Tor exit node egress policies.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.