147.161.3.20📋 Copy

# IP Intelligence Briefing: 147.161.3.20/32

Classification: Moderate Risk Tor Exit Node

Date of Analysis: 2026-07-31

Prepared by: IPDebrief Threat Intelligence

---

## Executive Summary

IP address 147.161.3.20 is a confirmed Tor exit node operating from the Srvnet_LTD network (ASN 399486). The IP presents a moderate risk profile (score: 59/100) with active Tor exit node indicators and one confirmed blacklist listing. The IP is geolocated to Amsterdam, CZ (Prague timezone) and maintains a stable ownership history with no persistent malicious behavior observed.

---

## Threat Indicators

• Tor Exit Node Status: Confirmed (isTor: true)
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 1 (DNSBL listed)
• Risk Score: 59 (Moderate Risk)
• Threat Persistence: No (threatObservationCount: 1)

The IP has been flagged by threat feeds for Tor exit node activity. While not classified as a known attacker or spam source, Tor exit nodes present elevated risk for anonymized malicious traffic and should be treated as suspicious for inbound connections.

---

## Network Context

Ownership:

• ASN: 399486 (netutils-mnt / Srvnet_LTD)
• CIDR Block: 147.161.3.0/24
• RIR: ARIN
• Registration Date: Not available

Geolocation:

• Country: Czech Republic (CZ)
• Region: NH
• City: Amsterdam
• Coordinates: 49.82°N, 15.47°E
• Accuracy Radius: 200km

Network Stability:

• Route Changes (30d): 1
• Route Stability: Unstable (isRouteStable: false)
• DNSSEC Valid: Yes
• BGP Origin ASN: 399486

---

## Neighborhood Analysis

The /24 subnet (147.161.3.0/24) contains 5 active sibling IPs with the following risk distribution:

• High Risk: 0
• Medium Risk: 4 (scores: 66, 59, 70, 59)
• Low Risk: 0

Neighbor IPs:

Subnet abuse density indicates moderate activity, with all siblings presenting medium to high risk scores. The subnet should be monitored collectively.

---

## Service & Port Analysis

• Open Ports: None detected
• Service Status: Firewalled / No Services
• TLS Certificate: None
• HTTP Title: None
• DNS Hostnames: None

The IP does not expose any active services, which is consistent with Tor exit node behavior that typically routes traffic without hosting additional services.

---

## Historical Observations

Observation Count: 45 signals recorded

Recent Activity (2026-07-31):

• Multiple blacklist detections (signal_type_id: 2344) with high severity ratings
• Consistent geolocation signals from CZ (Cymru)
• Blacklist listings maintained across 8 total lists with 1 active listing

The IP shows persistent Tor exit node activity without escalation to known attacker behavior.

---

## Recommended Actions

Firewall Rules:

```

# Block Tor exit node traffic (recommended)

iptables -A INPUT -s 147.161.3.20/32 -j DROP

```

Monitoring:

• Monitor for connection attempts from this IP
• Track subnet-wide activity (147.161.3.0/24)
• Review firewall logs for any attempted connections

Assessment: This IP should be blocked for inbound connections to prevent potential abuse through Tor anonymity. The moderate risk score combined with Tor exit node classification warrants defensive treatment.

---

Report Generated: IPDebrief Intelligence Platform

Data Sources: Real-time threat feeds, geolocation databases, historical signal logs

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.