171.25.193.235
IP Intelligence Briefing: 171.25.193.235
Date: June 9, 2026
---
**Overview**
- Risk Score: 66/100 (Moderate Risk)
- Network Role: Tor Exit Node
- Ownership: DFRI-MNT (APNIC)
- Geolocation: Sweden (SE), associated with London (potential misclassification)
- Threat Indicators: Tor exit node activity detected
---
**Key Findings**
1. Tor Exit Node Activity
- The IP is actively used as a Tor exit node, which is a common entry point for anonymized traffic.
- Historical data shows consistent signals (last 30 days) with no significant changes in risk profile.
2. Network Relationships
- Linked to the subnet 171.25.193.0/24 (abuse density: 0%).
- Associated with the hostname tor-exit-read-me.dfri.se (DNS PTR confirmed).
- No direct connections to known malicious entities or campaigns.
3. Subnet Analysis
- Subnet 171.25.193.0/24 has 20 IPs, with 19 active.
- Neighboring IPs show mixed risk scores (40–70), but no elevated threats.
4. Security Recommendations
- Block the IP due to Tor exit node association and moderate risk score.
- Monitor anonymous traffic from this subnet for irregular patterns.
---
**Actionable Steps**
- Firewall Rules:
- `iptables -A INPUT -s 171.25.193.235 -j DROP`
- `nft add rule inet filter input ip saddr 171.25.193.235 drop`
- WAF Configuration:
- Add to Cloudflare/AWS WAF as a blocked IP with description: *"IPDebrief risk 66"*.
- DNS Monitoring:
- Track tor-exit-read-me.dfri.se for DNS anomalies or abuse.
---
**Conclusion**
The IP is a Tor exit node with moderate risk, likely used for anonymized traffic. While not directly malicious, its association with Tor requires vigilance. Implement blocking rules and monitor related network activity to mitigate potential threats.
Tools Used: IPDebrief Profile, History, Relationships, Neighbors, Actions.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | DFRI-MNT |
| ASN | AS198093 |
| Network Name | — |
| CIDR Block | — |
| RIR | APNIC |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | tor-exit-read-me.dfri.se |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | tor-exit-read-me.dfri.se |
🔐 DNS Hygiene
| Hygiene Score | 100% (Excellent) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Verified |
| DNSSEC | Valid |
| CAA | Present |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 24% | 2 | 3 |
| routing | 13% | 1 | 1 |
| services | 15% | 2 | 2 |
| ownership | 24% | 2 | 3 |
| reputation | 26% | 1 | 3 |
| geolocation | 27% | 2 | 3 |
| Overall | 22% | 10 | 15 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (70%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-22 13:35:39 UTC |
| Last Seen | 2026-06-26 21:06:48 UTC |
| Profile Built | 2026-06-27 10:35:12 UTC |
| Data Freshness | Live |
| Signal Types | 22 |
| Total Observations | 50 |
Full dossier details are available via our API.