107.189.8.65📋 Copy

## THREAT INTELLIGENCE BRIEFING

Target IP: 107.189.8.65/32

Classification: Tor Exit Node / Moderate Risk Infrastructure

Date: Current Assessment

EXECUTIVE SUMMARY

IP 107.189.8.65 is a Tor exit node operated by BuyVM (ASN 53667) with a moderate risk score of 49. The IP exhibits Tor-related threat indicators and is associated with the tor-exit-node.net infrastructure. While classified as a Tor exit node, the subnet shows relatively low abuse density compared to typical Tor infrastructure.

INFRASTRUCTURE PROFILE

THREAT INDICATORS

• Tor Exit Node: Confirmed (isTorExit: true)
• Blacklist Status: Listed on 1 DNS blacklist (of 8 total lists)
• Threat Feeds: No known malicious campaigns or attacker associations
• Known Attacker: False
• Spam Source: False

NETWORK SERVICES

TLS Certificate: Self-signed certificate detected (issuer: www.qlihcwiu2vndi6o3tjn.com, subject: www.elhh26xzwx.net). Certificate configuration warrants monitoring.

OBSERVATION HISTORY

52 total observations recorded. Recent signals indicate:

• Risk Trend: Minimal risk observed in recent probes (June 2026 timeframe)
• Connection Status: Intermittent connection failures observed
• Threat Persistence: 0 days of persistent malicious activity
• Stability: IP ownership has not changed

NETWORK CONTEXT

• Subnet Classification: High abuse density (107.189.8.0/24)
• Neighbor Count: 6 active siblings within /24
• Neighbor Risk Scores: 49-55 (medium risk range)
• Network Label: BUYVM-LUXEMBOURG-03
• DNS Association: lux2.tor-exit-node.net

SOC ACTIONS RECOMMENDED

1. Allow with Logging: Permitted traffic from known Tor exit node; monitor for anomalous patterns

2. SSH Monitoring: SSH service (port 22) is exposed; correlate with authentication logs

3. Certificate Alert: Self-signed TLS certificate detected; verify legitimacy if HTTPS traffic is observed

4. Subnet Context: Consider broader subnet (107.189.8.0/24) in threat hunting; 6 medium-risk neighbors present

5. Baseline Expectation: Expect Tor-related traffic patterns; false positives likely for anonymized traffic

RISK ASSESSMENT

This IP represents typical Tor exit node behavior. Legitimate use cases include privacy-conscious users and journalists. The moderate risk score reflects Tor exit node characteristics rather than confirmed malicious activity. No evidence of active malware distribution or known attack campaigns.

Recommendation: Monitor but allow; correlate with threat intelligence for any emerging malicious activity from this infrastructure.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.