147.161.3.32📋 Copy

# IP Intelligence Briefing: 147.161.3.32/32

## Executive Summary

IP address 147.161.3.32 is a Tor exit node operating from ASN 399486 (Srvnet_LTD) with a risk score of 70/100 (High Risk). The IP is actively listed on threat intelligence feeds and exhibits characteristics consistent with anonymized proxy infrastructure. Immediate defensive action is recommended.

## Technical Profile

Network Identity:

• ASN: 399486 (netutils-mnt, Srvnet_LTD)
• CIDR Block: 147.161.3.0/24
• RIR: ARIN
• Network Classification: Tor Exit Node

Geolocation:

• Consensus Location: Amsterdam, Netherlands (coordinates: 52.37°N, 4.89°E)
• Country Code: CZ
• Geo-plausibility: Valid (RTT 25-29ms, 5 probe count)

Service Exposure:

• Port 443/TCP: HTTPS (TLS certificate: CN=www.bd7z4gd73ot33txvqxg.com, self-signed)
• Port 22/TCP: SSH (OpenSSH_8.9p1 Ubuntu-3ubuntu0.16)

## Threat Indicators

• Tor Exit Node: Confirmed (isTor: true)
• Blacklist Status: Listed on 1 DNSBL with 8 total blacklist mentions
• Abuse Confidence: High risk score (70/100)
• Threat Observations: 1 threat persistence event recorded
• Route Stability: Unstable (1 route change in 30 days)

## Neighborhood Analysis

Subnet 147.161.3.0/24 shows elevated abuse density:

• 4 identified neighbors with risk scores ranging from 59-66
• Risk distribution: 0 high, 4 medium, 0 low
• Classification: Mostly clean but with inherited risk of 12

## Observation History

Signal history indicates sustained threat presence:

• 43 total observations recorded
• Recent observations (July 31, 2026) show consistent blacklist activity with maximum severity: high
• Multiple blacklist listings across 8 different threat feeds

## Recommended Actions

Immediate:

1. Block at perimeter firewall using provided rules (iptables, nftables, pfSense, Cloudflare WAF, AWS WAF)

2. Increase logging verbosity for traffic from this subnet

3. Implement enhanced verification for anonymous traffic patterns

Rationale: Tor exit nodes are frequently used for malicious activity including command-and-control communications, spam distribution, and credential harvesting. The subnet's elevated abuse density warrants proactive blocking.

Firewall Rule Example:

```

iptables -A INPUT -s 147.161.3.32 -j DROP

```

## Conclusion

This IP represents a known Tor exit node with active threat intelligence associations. The combination of Tor infrastructure designation, blacklist presence, and subnet abuse density supports blocking at the network perimeter. Continuous monitoring of the /24 subnet is recommended due to inherited risk from neighboring addresses.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.