173.255.198.243📋 Copy

# THREAT INTELLIGENCE BRIEFING

IP Address: 173.255.198.243/32

Classification: Moderate Risk Tor Exit Node

Report Generated: Current Session

Data Sources: IPDebrief Intelligence Platform

---

## EXECUTIVE SUMMARY

IP 173.255.198.243 is a Linode-hosted Tor exit node located in Richardson, Texas (US). The address exhibits Tor exit node characteristics and has been observed in threat feeds. The IP maintains moderate risk posture with a risk score of 49/100. Network neighborhood analysis indicates low abuse density (0.0) within the /24 subnet, with one sibling IP (173.255.198.110) showing zero risk.

---

## OWNERSHIP & INFRASTRUCTURE

The IP resolves to hostname `brutus.relaymagic.org` via forward DNS. Network classification identifies this address as a Tor exit node with HTTPS service on port 443. TLS certificate indicates issuer CN=www.bwiu7lg3cgbu.com with subject CN=www.q3o6wunve7eqdrk.net.

---

## THREAT ASSESSMENT

Current Risk Profile

• Overall Risk Score: 49 (Moderate)
• Abuse Confidence: Not quantified
• Blacklist Status: Listed on 1 DNSBL out of 8 total lists
• Threat Indicators: Tor exit node indicators observed

Network Role

• Primary Classification: Tor Exit Nodes
• Infrastructure Type: Unknown
• Provider Score: 0
• Authority Score: 0

---

## OBSERVATION HISTORY

Total Observations: 51 signals

Recent Trend: Stable low-risk signals

Observation timeline shows consistent "Minimal" risk labels across the past week:

• 2026-06-27 10:45 UTC: Operator score 0, confidence 0.30
• 2026-06-27 03:32 UTC: Operator score 0, confidence 0.30
• 2026-06-26 21:21 UTC: Operator score 0, confidence 0.30
• 2026-06-26 15:20 UTC: Operator score 0, confidence 0.30

No evidence of escalating malicious activity or persistent threat behavior. Threat observation count: 1.

---

## RELATIONSHIP MAPPING

Total Relationships: 344 entities

Primary Associations:

• Same Network: Multiple LINODE network entries
• DNS Associations: brutus.relaymagic.org
• Additional Entities: 339+ relationship records (hostnames, certificates, related IPs)

The IP maintains standard Linode infrastructure relationships with DNS-based hostname associations.

---

## NEIGHBORHOOD ANALYSIS

Subnet: 173.255.198.243/24

Abuse Density: 0.0 (Low)

Classification: Mostly Clean

The /24 subnet demonstrates minimal abuse activity, inherited risk score of 2, and no correlation with known malicious campaigns.

---

## GEOGRAPHIC VALIDATION

Location Confidence: GeoPlausible = false

RTT Anomaly: 55ms minimum observed vs 159.6ms minimum expected for 7979km distance

Probe Count: 5

Distance Violation: RTT 55.0ms < minimum possible 159.6ms for 7979km

Geolocation data shows 2500km accuracy radius with RTT anomalies suggesting potential location spoofing or proxy usage.

---

## SECURITY RECOMMENDATIONS

Immediate Actions

1. Monitor Tor Traffic: Implement egress filtering for Tor exit node traffic if policy prohibits

2. DNSBL Verification: Review blacklist status across 8 DNSBL services

3. Connection Logging: Enable logging for connections from this IP to track usage patterns

Firewall Rules (Recommended)

• Monitor or allow based on organizational policy for Tor traffic
• Consider rate-limiting if Tor usage violates acceptable use policy
• No immediate blocking recommended due to moderate risk score and low neighborhood abuse density

SOC Analyst Notes

• This IP represents legitimate Tor infrastructure hosted on Linode
• No evidence of active malware distribution or known attack campaigns
• Historical data shows stable, non-escalating risk profile
• Geographic anomalies may indicate proxy usage but do not confirm malicious activity

---

## CONCLUSION

IP 173.255.198.243 is a Linode-hosted Tor exit node with moderate risk classification. The address exhibits expected Tor infrastructure characteristics without evidence of active malicious campaigns. Network neighborhood analysis supports a clean operational environment. SOC teams should monitor per organizational policy regarding Tor traffic but may permit connectivity with appropriate logging and monitoring controls.

Risk Rating: Moderate (49/100)

Action Required: Monitor/Allow based on policy

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.