152.89.39.187📋 Copy

IP Intelligence Briefing: 152.89.39.187

Date: 2026-06-10

---

**1. Risk Profile**

• Overall Risk Score: Low Risk (25/100)
• Threat Indicators: No malicious activity detected (no blacklists, campaigns, or abuse reports).
• Network Role: Tor Exit Node (classified as "Provider" in network infrastructure).
• Geolocation: Frankfurt, Germany (DE).

---

**2. Ownership & Infrastructure**

• ASN: 42807 (Administrative Contact).
• ISP: ARIN-regulated network (arin).
• Services:

- Open ports: HTTP (80), HTTPS (443), SSH (22).

- SSH banner: `SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13`.

• Control Plane:

- BGP prefix: `152.89.36.0/22`.

- AS path: `2914 9121 42807`.

- DNSSEC valid, route stability confirmed.

---

**3. Threat & Observation History**

• Recent Signals (30 days):

- No high-severity threats detected.

- Low-confidence observations (e.g., DNSSEC validity, route stability).

- No correlation with known malicious campaigns or domains.

• Historical Trends: Stable network behavior with no persistent malicious activity.

---

**4. Network Relationships**

• Linked Networks: Multiple entries tied to `TR-CIZGI-20190123` (possible typo or internal network identifier).
• Subnet: `152.89.39.187/24` (no malicious neighbors detected).
• Abuse Density: 0 (clean subnet).

---

**5. Recommendations**

• Monitor: Track network relationships linked to `TR-CIZGI-20190123` for anomalies.
• Verify: Confirm Tor exit node activity aligns with expected traffic patterns.
• Baseline: Use historical data to establish normal behavior for this IP.

Conclusion: This IP appears benign, but its association with Tor and unclear network relationships warrants further investigation. No immediate action required, but continuous monitoring is advised.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.