147.161.3.33📋 Copy

INTELLIGENCE BRIEFING: IP 147.161.3.33/32

Classification: Moderate Risk – Tor Exit Node Infrastructure

Date: 2024

---

Executive Summary

IP address 147.161.3.33 is identified as a Tor exit node with a risk score of 59/100 (Moderate Risk). The IP belongs to ASN 399486 (netutils-mnt/Srvnet_LTD) within the 147.161.3.0/24 subnet. Geographic validation indicates a potential discrepancy between reported Czech Republic location and Montreal, Quebec coordinates. All five sibling IPs in the /24 subnet show threat indicators, suggesting concentrated malicious infrastructure.

---

Technical Profile

Ownership & Registration

• ASN: 399486
• Organization: netutils-mnt / Srvnet_LTD
• Network Block: 147.161.3.0/24
• Registration: ARIN (delegation age: 1,948 days)

Geolocation Analysis

• Reported Country: CZ (Czech Republic)
• Reported City: Montreal, Quebec (Canada)
• Validation Status: GeoPlausible=true, GeoConsensus=false
• Distance Discrepancy: 613.1 km from expected location
• Assessment: Geographic data conflict indicates potential misattribution or spoofing

Network Role Classification

• Primary Role: Tor Exit Node
• Service Purpose: Web Server
• Infrastructure Type: Not CDN, not Cloud, not VPN, not Hosting
• Classification Flags: isTor=true, isTorExit=true

---

Threat Indicators

Open Services

• Port 443/TCP: HTTPS (standard web server)
• Port 22/TCP: SSH (OpenSSH 8.9p1 Ubuntu-3ubuntu0.16)
• TLS Certificate: Issuer CN=www.g27oprp7jsqk5l.com / Subject CN=www.ji7hlqn6.net (suspicious random alphanumeric domain names)

---

Neighborhood Analysis (147.161.3.0/24)

Subnet Risk Profile

• Abuse Density: 1.0 (elevated)
• Total Siblings: 5
• Threat Siblings: 5 (100% threat rate)
• Classification: mostly_clean (contradicted by sibling analysis)

Neighbor IPs with Risk Scores

Assessment: The entire /24 subnet demonstrates concentrated threat activity. All four monitored sibling IPs maintain risk scores between 59-66, indicating coordinated infrastructure or shared compromise.

---

Observation History

Temporal Analysis: 53 total observations recorded

• Recent Operator Score: 0.15 (Minimal operator presence)
• BGP Communities: 6 communities detected
• Route Stability: Stable BGP origin
• Threat Persistence: 0 days (no persistent malicious indicators)
• Observation Trend: No escalation pattern detected

---

Related Entities

Network Relationships: 108 relationships identified

• Primary network association: Srvnet_LTD
• Multiple same-network linkages to Tor infrastructure

---

Recommended Security Actions

Priority 1: Access Control

• Recommendation: Consider enhanced verification for anonymous traffic
• Severity: Medium
• Rationale: Tor exit indicators observed; traffic may originate from compromised or malicious sources

Priority 2: Monitoring Enhancement

• Recommendation: Increase logging verbosity and review recent activity from this IP
• Severity: High
• Rationale: Elevated risk score (59/100); subnet shows 100% threat sibling rate

Recommended Firewall Rules

---

Intelligence Assessment

Threat Level: Moderate

Confidence: High

Action Required: Block or monitor based on organizational policy for Tor exit nodes

Key Concerns:

1. Geographic validation failure (Czech Republic vs. Montreal)

2. 100% threat rate across /24 subnet neighbors

3. Suspicious TLS certificate with random alphanumeric domain names

4. Active Tor exit node status indicating anonymous traffic potential

Recommendation: Implement blocking at network perimeter. Monitor for lateral movement if traffic from this subnet is permitted. Review broader subnet 147.161.3.0/24 for additional threat indicators.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.