149.102.153.38📋 Copy

IP Intelligence Briefing: 149.102.153.38

Date: 2026-06-09

---

**1. Core Profile**

• Risk Score: 59 (Moderate Risk)
• Provider: Cogent Communications, LLC (ASN 51167)
• Geolocation: Portsmouth, England, US (latitude/longitude unspecified)
• Threat Indicators:

- Tor exit node (confirmed via DNS: `uk1tor.quetzalcoatl-relays.org`)

- Listed in 1 DNSBL (high-severity listing)

• Network Role: Tor exit node (no active services or hosting)
• DNS:

- PTR hostname: `uk1tor.quetzalcoatl-relays.org`

- SPF record present, no DMARC

---

**2. Observation History**

• Recent Activity (2026-06-09):

- High-severity DNSBL listing (1 entry).

- Operator score: "Basic" (0.3478).

- No persistent malicious activity detected.

• Trend: Single threat observation; no escalation in risk over time.

---

**3. Relationships**

• Network Links:

- Linked to Cogent Communications' network (`COGENT-149-102-16`).

- No other IPs in the same /24 subnet (neighbors tool returned 0 entries).

• Threat Context:

- No direct connections to known malicious campaigns or domains.

---

**4. Neighborhood Analysis**

• Subnet: `149.102.153.38/24`
• Abuse Density: 0 (subnet is "mostly clean").
• Neighbors: No active sibling IPs in the subnet.

---

**5. Recommendations**

• Monitoring: Track Tor exit node traffic to detect potential abuse (e.g., C2 communication, data exfiltration).
• Firewall: Consider blocking Tor exit nodes if not required for legitimate use.
• Network: Verify Cogent Communications' network for broader risk exposure.

---

Conclusion: This IP is a Tor exit node with moderate risk due to DNSBL listing. While no direct malicious activity is observed, its role as a Tor exit node warrants monitoring for potential misuse. No immediate action is required unless traffic through this IP is flagged for suspicious behavior.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.