109.237.27.11📋 Copy

# IP Intelligence Briefing: 109.237.27.11/32

Classification: Moderate Risk

Date of Analysis: Current

Primary Threat Indicator: Tor Exit Node Activity

---

## Executive Summary

IP 109.237.27.11 presents a moderate risk profile (score: 49/100) with confirmed Tor exit node indicators. Hosted on Linode infrastructure in London, the IP exhibits typical Tor exit node behavior with HTTPS services. While the /24 neighborhood shows clean abuse density, the single blacklist entry and Tor exit node classification warrant defensive monitoring.

---

## Technical Profile

Network Ownership:

• ASN: 63949 (Linode)
• Organization: linode-mnt
• Geolocation: London, ENG, GB
• CIDR Block: 109.237.24.0/22 (control plane origin)
• BGP Path: 37100 → 63949

Network Role & Classification:

• Primary Classification: Tor Exit Nodes
• Risk Score: 49 (Moderate)
• Stability: Consistent ownership over 4,125+ days
• Route Status: Stable (0 route changes in 30 days)

Service Footprint:

• Open Ports: TCP/443 (HTTPS)
• DNS Resolution: 109-237-27-11.ip.linodeusercontent.com
• TLS Certificate: Issued to multiple domains (www.qe4j6kyl7fo732aq.com, www.bq6fjmkgv7.net)
• Forward Resolution: Confirmed (1 hostname)

---

## Threat Intelligence

Active Threat Indicators:

• Tor exit node indicators observed
• Blacklist Count: 1 (DNSBL listed)
• Abuse Confidence: Present but not classified as known attacker
• Campaign Correlation: None detected

Temporal Analysis:

• Observation Count: 51 historical signals
• Risk Trend: Minimal risk labels in recent observations (2026-06-27)
• Threat Persistence: Single threat observation event
• Connection Status: Occasional HTTPS connection failures observed

Control Plane Validation:

• RIR Registry: APNIC
• DNSSEC: Valid
• RPKI State: Not reported
• Operator Score: 0.4348 (Basic)

---

## Neighborhood Analysis

Subnet Assessment: 109.237.27.0/24

• Abuse Density: 0% (Clean)
• Threat Siblings: 0
• Total Siblings: 1 (active)
• Inherited Risk: 0
• Classification: Clean

The IP operates in a low-abuse subnet with no correlated threat activity from neighboring addresses.

---

## Relationship Graph

Identified Associations (500 relationships):

• DNS: 109-237-27-11.ip.linodeusercontent.com
• Network: US-LINODE-20100108
• Primary Link Type: Same Network / DNS Association

---

## Recommended Actions

Defensive Posture:

1. Monitor for Tor Exit Node Activity – The IP's classification as a Tor exit node suggests potential anonymization traffic. Implement monitoring for unusual connection patterns.

2. Blacklist Review – Review the single DNSBL listing to determine source and relevance.

3. HTTPS Traffic Inspection – Given the HTTPS service and multiple certificate subjects, consider SSL inspection or proxy logging.

4. Geofencing – Based on London location, adjust firewall rules according to organizational geo-policies.

5. Connection Failure Logging – The observed connection failures warrant investigation for potential rate limiting or probe activity.

Firewall Rule Template (iptables):

```bash

# Block Tor exit node (adjust based on policy)

iptables -A INPUT -d 109.237.27.11 -j DROP

```

---

Analyst Notes: While the IP maintains a clean neighborhood and stable ownership history, the Tor exit node classification is the primary risk factor. No known attack campaigns or persistent malicious activity detected. Recommend monitoring rather than immediate blocking, aligned with organizational Tor policy.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.