166.70.207.2📋 Copy

IP Intelligence Briefing: 166.70.207.2

Date: 2026-06-09

---

**1. Core Profile**

• Risk Rating: High Risk (70/100)
• Provider: XMission, L.C. (AS6315)
• Geolocation: New York, NY, US (ARIN registered)
• Network Role: Tor Exit Node (confirmed via BGP and DNS records)
• Threat Indicators:

- Listed in 2 DNSBLs

- Tor exit node activity detected

- No known malware campaigns or spam sources

---

**2. Observation History**

• Consistent Signals: Tor exit node activity has been observed since at least 2026-06-09.
• Risk Stability: No significant changes in risk scores over the past 30 days.
• DNS Activity: Persistent DNS associations with `this.is.a.tor.exit.xmission.com`.

---

**3. Relationships**

• Linked Entities:

- DNS: `this.is.a.tor.exit.xmission.com` (XMission domain)

- Network: Subnet `166.70.0.0/16` (XMission infrastructure)

• No Known Campaigns: No correlation with malicious campaigns or certificates.

---

**4. Neighborhood Analysis**

• Subnet: `166.70.207.2/24` (no active siblings detected)
• Abuse Density: Clean (0% abuse detected in subnet)
• Neighbors: No neighboring IPs found (likely due to /32 subnet).

---

**5. Recommended Actions**

• Block Traffic: Consider blocking outbound connections to this IP if not explicitly required, given its Tor exit node status.
• Monitor DNS: Watch for DNS requests to `this.is.a.tor.exit.xmission.com` in your network.
• Verify Ownership: Confirm XMission’s compliance with your organization’s acceptable use policies.
• Firewall Rules: Use IPDebrief’s action generator to create rules for iptables, Cloudflare WAF, or AWS WAF.

---

Conclusion: This IP is a high-risk Tor exit node associated with XMission. While it does not exhibit direct malicious behavior, its use as a Tor exit node poses potential risks for privacy or anonymity-related threats. Monitor traffic and consider blocking unless explicitly needed.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.