172.234.228.174📋 Copy

# IP Intelligence Briefing: 172.234.228.174/32

Date: Current Analysis

Classification: Moderate Risk

Risk Score: 49/100

---

## Executive Summary

IP address 172.234.228.174 is classified as a Tor exit node operated by Linode (ASN 63949) in Tukwila, WA, US. The IP demonstrates moderate risk characteristics consistent with anonymous traffic patterns. Primary concern: Tor exit node designation with associated anonymity implications.

---

## Threat Indicators

Threat Observations: Tor exit indicators detected. IP serves as proxy endpoint for anonymous traffic, potentially facilitating command-and-control, credential stuffing, or other malicious activities while obscuring true source identity.

---

## Network Infrastructure

• Organization: Linode
• ASN: 63949
• CIDR Block: 172.234.224.0/19
• Service Purpose: Web Server (HTTPS:443)
• Control Plane: Route stable (0 route changes in 30 days)
• RPKI State: Validated
• Operator Score: 0.3913 (Basic)

DNS Profile:

• PTR Hostname: `bluto.relaymagic.org`
• Forward Resolution: Confirmed
• SPF/DMARC: Both records present
• Domain: relaymagic.org

---

## Geolocation Analysis

• Location: Tukwila, WA, US
• Data Quality: GeoPlausible = false
• RTT Anomaly: 79ms observed vs. 157.9ms minimum possible for stated distance (7,893km) — indicates geolocation data may be inaccurate or spoofed

---

## Historical Trend Analysis

Total observations: 49 signals over monitoring period. Recent activity shows:

• Risk scores consistently minimal (0) across multiple observations
• No observed escalation in threat behavior
• Single threat observation recorded
• Not flagged as persistently malicious

Conclusion: IP maintains relatively stable profile without recent behavioral escalation.

---

## Neighborhood Assessment

• Subnet: 172.234.228.174/24
• Abuse Density: 1 (classified as "mostly_clean")
• Active Siblings: 1
• Threat Siblings: 1
• Inherited Risk: 2

---

## Recommended Actions

Recommended Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 172.234.228.174 -j DROP

# nftables

nft add rule inet filter input ip saddr 172.234.228.174 drop

# nginx

deny 172.234.228.174;

# pfSense

172.234.228.174/32

# Cloudflare WAF

{"description":"Block 172.234.228.174 — IPDebrief risk score 49","action":"block"}

```

---

## Relationship Mapping

• Same Network: LINode (multiple associations)
• DNS Association: bluto.relaymagic.org
• Certificate Authority: CN=www.ldtkjgyqkzl.com / CN=www.u6emk7rvzyyqctdzci.net

---

## Intelligence Assessment

The IP address functions as a Tor exit node, a legitimate infrastructure type but frequently abused for anonymizing malicious traffic. While the IP itself is not flagged as a known attacker or spam source, its function as an anonymous proxy endpoint warrants monitoring. The moderate risk score (49) reflects the inherent ambiguity of Tor exit node traffic — legitimate use cases exist alongside potential abuse scenarios.

Recommendation: Implement enhanced verification controls for traffic from this IP. Block by default if traffic is unexpected for your use case. Monitor for patterns indicating abuse (e.g., credential stuffing attempts, high-frequency requests, unusual ports).

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.