171.25.193.80📋 Copy

IP Intelligence Briefing: 171.25.193.80/32

*Generated for SOC Analysts*

---

**1. Core Profile**

• Risk Score: 40 (Moderate Risk)
• Ownership:

- ASN: 198093 (DFRI-MNT)

- Geolocation: London, UK (GB)

- Network Role: Tor Exit Node (classified as "Firewalled / No Services")

• Threat Indicators:

- No active threat indicators, abuse confidence score, or blacklist listings.

- No known attacker, spam, or Tor exit node flags.

---

**2. Observation History**

• Recent Signals:

- Consistent network classification as "SE-TORNET" (DFRI-MNT) since May 2026.

- Traceroute data shows transit through Comcast and Cogent networks.

- DNS resolution to `tor-exit-read-me.dfri.se` (likely a Tor exit node hostname).

• Stability:

- No significant changes in risk or network behavior over the past 30 days.

---

**3. Relationships & Dependencies**

• Key Associations:

- Linked to SE-TORNET (DFRI-MNT) via multiple signals.

- DNS records point to `tor-exit-read-me.dfri.se`, suggesting Tor-related infrastructure.

- No direct connections to known malicious domains, organizations, or certificates.

• Network Role:

- Classified as a Tor Exit Node, which may be used for anonymized traffic but lacks direct malicious activity indicators.

---

**4. Neighborhood Analysis**

• Subnet: 171.25.193.0/24 (20 total IPs)
• Risk Distribution:

- 19 IPs classified as low/medium risk (abuse density: 0).

- Notable high-risk neighbors:

- 171.25.193.38 (risk: 70), 171.25.193.82 (risk: 70), 171.25.193.235 (risk: 66).

• Context:

- Subnet appears clean, but high-risk neighbors may indicate a broader network of potentially compromised or malicious hosts.

---

**5. Actionable Insights**

• Monitor Traffic:

- Track traffic to/from this IP for anomalies, especially given its Tor exit node association.

• Investigate Neighbors:

- Focus on high-risk neighbors (e.g., 171.25.193.38, 171.25.193.82) for potential lateral movement or shared infrastructure.

• DNS & TLS:

- Verify DNS records (`tor-exit-read-me.dfri.se`) for malicious activity or misconfigurations.

• Firewall Rules:

- Consider blocking or monitoring traffic to this IP if it aligns with known malicious patterns (e.g., C2, exfiltration).

---

Conclusion:

This IP is associated with Tor exit node infrastructure but shows no direct malicious activity. Its classification as a Tor node and connections to high-risk neighbors warrant further investigation. SOC teams should prioritize monitoring traffic patterns and validating DNS/TLS behavior to mitigate potential risks.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.