147.90.235.17📋 Copy

## IP Intelligence Briefing: 147.90.235.17

Classification: HIGH RISK TOR EXIT NODE

Risk Score: 70/100

Date: 2026-06-21

Executive Summary

IP address 147.90.235.17 operates as a Tor exit node registered to Fourplex Telecom LLC (ASN: 27284). The IP demonstrates high-risk characteristics with Tor exit node indicators, single-HTTP service exposure, and membership in a high-abuse-density subnet (0.9167). Geographic validation failures indicate potential spoofing. Immediate defensive measures recommended.

---

Network Profile

Threat Indicators

• Tor Exit Node: Confirmed via threat indicators
• Blacklist Status: Listed on 1 of 8 DNSBLs
• Abuse Confidence: Elevated
• Geolocation Validation: FAILED - RTT 19ms inconsistent with claimed 5968km distance
• Geographic Discrepancy: Listed as Netherlands but geoPlausible flag false

Neighborhood Analysis (147.90.235.0/24)

The /24 subnet exhibits critical abuse concentration:

• Abuse Density: 0.9167 (91.67%)
• Classification: High Abuse
• Active Siblings: 11 of 12 IPs
• Threat Siblings: 11 of 12 IPs
• Neighbor Risk Distribution: 10 high-risk, 1 low-risk

High-Risk Neighbors Include:

• 147.90.235.16 (66)
• 147.90.235.22 (66)
• 147.90.235.40 (66)
• 147.90.235.15, .20, .21, .226, .227, .228, .249 (59)

Historical Observations

37 total observations recorded. Recent activity shows:

• Port scanning behavior observed
• Single HTTP service (port 80) exposed
• No persistent malicious behavior flagged (threatPersistenceDays: 0)

---

Recommended Actions

Immediate (High Severity):

1. Block at perimeter firewall

```bash

iptables -A INPUT -s 147.90.235.17 -j DROP

nft add rule inet filter input ip saddr 147.90.235.17 drop

```

Monitoring Enhancements:

2. Increase logging verbosity for all traffic from 147.90.235.0/24 subnet

3. Enable enhanced verification for anonymous traffic patterns

4. Review recent activity from this IP for potential abuse campaigns

Application-Level Controls:

```nginx

nginx: deny 147.90.235.17;

Cloudflare WAF: Block IP 147.90.235.17 (Risk: 70)

AWS WAF: Add 147.90.235.17/32 to block list

```

---

Intelligence Notes

• Subnet abuse density (91.67%) indicates coordinated threat activity within 147.90.235.0/24
• Geolocation spoofing detected—legitimate Netherlands placement contradicted by network telemetry
• Single HTTP service exposed increases attack surface for exploitation
• No certificate-based identification—traffic likely unauthenticated
• Consider blocking entire /24 if traffic volume permits (11/12 neighbors classified as threats)

Recommended Severity: HIGH

Action Priority: Immediate

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.