172.104.186.73📋 Copy

IP Intelligence Briefing: 172.104.186.73

*Generated via IPDebrief tools (profile, history, relationships, neighbors)*

---

**Core Profile**

• Risk Score: 59 (Moderate Risk)
• Provider: Linode (ASN 63949)
• Network Role: Tor Exit Node (marked as "Web Server" with SSH, HTTP, HTTPS services)
• Threat Indicators:

- Tor exit node observed (potential privacy/attack vector).

- DNS blacklisted (2/8 lists) and flagged for Tor exit activity.

• Geolocation: Singapore (SG), plausible but unusual for Tor exit nodes.
• Ownership: Linode (ARIN-regulated), abuse contact available.

---

**Observation History**

• Recent Activity:

- 15 June 2026: Flagged in DNS blacklists (2/8 lists) with high-severity indicators.

- 11 June 2026: Operator score "Basic" (0.39), route stability confirmed.

- 2 June 2026: DNS resolution attempts with mixed success (some failed connections).

• Trend: No persistent malicious activity detected; risk score stable.

---

**Network Relationships**

• Linked Entities:

- Domain: `tor-exit.sg.localenby.is` (DNS PTR record).

- Organization: Linode (same ASN).

- Services: SSH (OpenSSH 9.2), HTTP/HTTPS (no banners).

• Certificates:

- TLS certificate issued to `www.6banyfjrpo.com` (self-signed, no SANs).

---

**Subnet Neighbors**

• Subnet: 172.104.186.0/24
• Neighbor Risk:

- 2 IPs with low risk (25/100 score).

- Subnet abuse density: 0.6667 (mostly clean, but some risk).

---

**Actionable Insights**

1. Monitor Traffic:

- Track outbound traffic from this Tor exit node for C2 or data exfiltration.

- Check for DNS leaks or unintended connections to `localenby.is`.

2. Blocklist Consideration:

- Add to DNS-layer filters due to blacklisted status.

3. Verify Ownership:

- Linode’s abuse contact is available; confirm if this IP is compromised.

4. Subnet Review:

- While neighbors are low-risk, the subnet’s moderate abuse density warrants closer scrutiny.

Conclusion: This IP is a Tor exit node with mixed risk factors. While not immediately malicious, its association with Tor and DNS blacklists makes it a potential vector for covert activities. SOC teams should prioritize monitoring and verify ownership to mitigate risks.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.