172.234.92.148📋 Copy

IP Intelligence Briefing: 172.234.92.148

Date: 2026-06-07

---

**1. Risk Profile**

• Risk Score: Moderate (59/100)
• Threat Indicators:

- Identified as a Tor exit node (potential anonymity tool).

- Observed Tor exit indicators in DNS and TLS data.

• Network Role:

- Classified as a Tor exit node (not a traditional web server).

- Associated with Linode (cloud provider, ASN 63949).

• Geolocation:

- Registered to US (region: Osaka, city: Osaka).

- Geolocation data inconsistent (null coordinates).

---

**2. Observation History**

• Recent Activity (2026-06-07):

- Detected TLS handshakes (TLS 1.3, Let’s Encrypt certificate).

- Open ports: HTTP (80) and HTTPS (443).

- Server banner: nginx.

- No signs of recent compromises or persistent malicious activity.

• Temporal Trends:

- No significant changes in risk scores or network behavior.

- Threat persistence: 0 days (not flagged as persistently malicious).

---

**3. Relationships**

• Linked Entities:

- Linode (cloud provider, ASN 63949).

- Tor network (exit node, potential anonymity tool).

- Domain: `brokenbotnet.com` (DNS PTR: `tor-exit.brokenbotnet.com`).

• Certificates:

- TLS certificate issued to `tor-exit.brokenbotnet.com` (Let’s Encrypt).

---

**4. Neighborhood Analysis**

• Subnet: `172.234.92.148/24`
• Abuse Density:

- 0 abuse incidents reported in the subnet.

- 0 neighboring IPs identified (possibly isolated or limited data).

• Subnet Classification: "Mostly clean" with no inherited risk.

---

**5. Recommendations**

• Monitor Traffic:

- Track Tor exit node activity, as it may be used for illicit communications or data exfiltration.

• Firewall Rules:

- Consider blocking Tor exit nodes if not required for legitimate use.

• Verify Ownership:

- Confirm Linode’s compliance with security practices for cloud-hosted Tor nodes.

---

Conclusion:

The IP is a Tor exit node associated with Linode, posing potential risks due to its anonymity capabilities. While no direct malicious activity is detected, its Tor association warrants further monitoring. No immediate action is required unless Tor usage is explicitly prohibited.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.