167.179.117.50📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 167.179.117.50/32

Classification: TOR EXIT NODE - MODERATE RISK

Date: Current

---

## EXECUTIVE SUMMARY

IP address 167.179.117.50 operates as a Tor exit node within Japan, presenting moderate risk (score: 59). The IP belongs to IRT-CHOOPALLC-AP (ASN 20473) on the TYO_VULTR_CUST network infrastructure. Current operational status indicates no open services; the endpoint is firewalled. A single blacklist listing and one threat-adjacent sibling IP are documented.

---

## TECHNICAL PROFILE

---

## THREAT INDICATORS

• Tor Exit Node: Confirmed active Tor exit node operation
• Blacklist Presence: 1 blacklist listing detected
• Reputation: No known attacker or spam source classification
• Campaign Correlation: None identified

---

## NEIGHBORHOOD CONTEXT

Subnet 167.179.117.50/24 shows low abuse density (0) with classification "mostly_clean." One active threat sibling IP identified within the subnet. No additional neighbor relationships detected. The IP is part of a larger 223-entity relationship cluster, primarily mapped to TYO_VULTR_CUST network infrastructure.

---

## OBSERVATION HISTORY

62 total signals observed. Recent monitoring (June 20, 2026) shows consistent operator scoring at 0.3913 ("Basic" classification) with route stability maintained. No significant temporal threat escalation patterns detected.

---

## RECOMMENDED ACTIONS

For SOC/Network Defense:

1. Monitor inbound connections from this Tor exit node for data exfiltration or command-and-control activity

2. Implement connection rate limiting for traffic originating from 167.179.117.0/24 subnet

3. Review any recent outbound connections to this IP for potential compromise indicators

4. Consider blocking or monitoring based on organizational policy for Tor exit node traffic

Firewall Rule Recommendation:

```

# Monitor Tor traffic from this exit node

iptables -A INPUT -s 167.179.117.50 -j LOG --log-prefix "TOR_EXIT:"

# Or block if policy prohibits

# iptables -A INPUT -s 167.179.117.50 -j DROP

```

---

## ANALYST NOTES

This IP represents legitimate Tor infrastructure rather than direct malicious activity. The primary concern is its use as an anonymization endpoint, which may be exploited by adversaries for C2 or exfiltration. The absence of open services reduces direct exploitation risk, but traffic analysis remains warranted.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.