144.31.237.91📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 144.31.237.91/32

Date: Analysis conducted

Classification: High Risk

---

## EXECUTIVE SUMMARY

The IP address 144.31.237.91 was classified as High Risk (70/100) during analysis. The address is registered to ETERNITY-NETWORK (ASN 212743) within the 144.31.237.0/24 block and demonstrated Tor exit node indicators. The IP maintains a firewalled posture with no open services observed.

---

## OWNERSHIP AND REGISTRATION

• ASN: 212743
• Organization: Abuse contact role object / ETERNITY-NETWORK
• RIR: ARIN
• CIDR Block: 144.31.237.0/24
• Registration Date: Not publicly disclosed
• Abuse Contact: abuse@eternitycloud.org (via RDAP)

---

## GEOLOCATION

• Country: United States (US)
• Region: US-NY
• City: New York
• Timezone: America/New_York
• Geographic Validation: GeoPlausible confirmed; ICMP validation blocked

---

## THREAT PROFILE

• Reputation: High Risk
• Risk Score: 70/100
• Tor Exit Node: Yes
• Blacklist Status: Listed on 1 blacklist; 3 DNSBL entries across 8 total lists
• Threat Indicators: Tor exit indicators observed
• Known Campaigns: None correlated

---

## NETWORK CHARACTERISTICS

• Network Role: Tor Exit Nodes
• Infrastructure Type: Unknown
• Open Services: None (firewalled / no services)
• DNS Resolution: No PTR hostnames; no forward resolution
• BGP Routing: Origin ASN 212743; BGP prefix 144.31.237.0/24
• Route Stability: Route not stable
• RPKI State: Not verified
• Traceroute: 27 hops to destination (7 timed out); transit via Comcast networks

---

## TEMPORAL ANALYSIS

• Observation Count: 1 threat observation
• Threat Persistence: 0 days
• Persistent Malicious: No
• Ownership Changes: 0
• Recent Signals: 20 observations recorded between 2026-07-23

---

## SUBNET NEIGHBORHOOD (144.31.237.0/24)

• Subnet Classification: Clean
• Abuse Density: 0%
• Total Siblings: 1
• Active Siblings: 0
• Threat Siblings: 0
• High/Medium/Low Risk Neighbors: None

---

## RELATIONSHIPS

• Connected Networks: ETERNITY-NETWORK (2 relationships)
• Related Entities: None beyond network affiliation
• Associated Certificates: None

---

## OBSERVATION HISTORY

Recent signals indicate:

• Operator score: Minimal (0.1304)
• Multiple ownership and routing signals observed
• Geographic data inconsistencies noted (NL vs US registration)
• Confidence levels varied (0.30–0.95) across observations

---

## RECOMMENDED ACTIONS

Access Control

Action: Consider enhanced verification for anonymous traffic

Severity: Medium

Rationale: Tor exit indicators observed; traffic may bypass standard authentication mechanisms

Monitoring

Action: Increase logging verbosity and review recent activity from this IP

Severity: High

Rationale: Elevated risk score (70/100) warrants enhanced visibility

Firewall Implementation

• iptables: `iptables -A INPUT -s 144.31.237.91 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 144.31.237.91 drop`
• nginx: `deny 144.31.237.91;`
• pfSense: `144.31.237.91/32` (block rule)
• Cloudflare WAF: Block with expression `ip.src eq 144.31.237.91`
• AWS WAF: Add address 144.31.237.91/32 to block list

---

## ANALYST NOTES

The IP address 144.31.237.91 is registered to ETERNITY-NETWORK but demonstrates Tor exit node behavior. Despite being geolocated to New York, US, some historical observations indicated NL (Netherlands). The subnet shows zero abuse density with no sibling threats. The firewalled state with no open services suggests the IP may serve as an anonymous relay rather than a hosting endpoint. Enhanced logging and monitoring are recommended due to the High Risk classification and Tor exit node characteristics.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.