178.218.144.64📋 Copy

IP Intelligence Briefing: 178.218.144.64

Date: 2026-06-16

---

**1. Core Profile**

• Risk Score: 70 (High Risk)
• Provider: LOWHOSTING-MNT (RIPE)
• Geolocation: Italy (Rovigo), Latitude/Longitude: N/A, Timezone: Europe/Rome
• Network Role: Hosting (Colocation)
• Services:

- Open ports: SSH (22/TCP), HTTPS-alt (8443/TCP)

- TLS Certificate: Issued to `www.lbvc4e6x3uemnx.com`, SANs unspecified

- No HTTP server banner detected

---

**2. Threat Indicators**

• Tor Exit Node: Confirmed (observed via Tor exit indicators)
• Abuse Flags:

- 1 DNSBL listing (potential spam or malicious activity)

- No known attacker campaigns or spam sources

• Subnet Abuse Density: 40% (medium risk within 178.218.144.0/24)

---

**3. Observation History**

• Recent Activity (Last 26 Observations):

- Tor exit node activity detected (1 observation)

- Minimal risk score (0.13) from 2349 signal type

- TLS certificate and SSH banner scans (no critical vulnerabilities)

- ICMP validation failed (potential firewall blocking)

---

**4. Network Relationships**

• Linked Entities:

- Same network: `IT-LowHosting-Services` (repeated 35+ times)

- Subnet: 178.218.144.0/24 (4 neighbors analyzed)

- DNS: `178.218.144.64.lowhosting.org` (PTR record confirmed)

---

**5. Neighborhood Analysis**

• Subnet (178.218.144.0/24):

- Total IPs: 256

- Active Neighbors: 2 (high/medium risk)

- Risk Distribution:

- 4 medium-risk neighbors (scores: 40–59)

- 1 high-risk neighbor (score: 59)

- Abuse Density: 40% (mostly clean, but elevated risk)

---

**6. Recommended Actions**

• Block Tor Exit Traffic:

- Implement firewall rules to restrict traffic from 178.218.144.64 to Tor networks.

• Monitor SSH Access:

- Audit SSH logs for unauthorized access attempts on port 22.

• Investigate Subnet Activity:

- Focus on neighbors with medium/high risk (e.g., 178.218.144.99).

• Verify TLS Certificates:

- Check validity of certificates for `www.lbvc4e6x3uemnx.com` and SANs.

---

Conclusion: This IP is associated with a hosting provider in Italy and exhibits Tor exit node activity. While not directly malicious, its subnet contains medium-risk neighbors, and the high-risk score warrants closer monitoring. SOC teams should prioritize isolating Tor-related traffic and validating TLS/SSH configurations.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.