180.149.45.21📋 Copy

# IP Intelligence Briefing: 180.149.45.21/32

## Executive Summary

IP 180.149.45.21 presents a moderate risk profile (score: 66/100) with confirmed Tor exit node activity. The IP operates from Frankfurt, Germany, within the GCL-CUSTOMER-AZ network block. While the subnet shows low abuse density (1.0), this specific address exhibits Tor-related threat indicators warranting defensive monitoring.

## Technical Profile

Network Classification:

• ASN: 202422
• Organization: GCL1-MNT
• Network Block: 180.149.45.0/24
• Geolocation: Frankfurt, DE (Baku City)
• RIR: APNIC

Network Role: Tor Exit Nodes

Service Exposure:

• Port 80 (HTTP)
• Port 443 (HTTPS)
• Port 22 (SSH - OpenSSH_9.2p1 Debian)

DNS Resolution: yepenit241.example.com (forward confirmation failed)

TLS Certificate: Self-signed certificate with issuer CN=www.s5cexdoyb2237i.com and subject CN=www.ecbajrluhbugdtjh6fk.net

## Threat Indicators

Primary Concern: Tor exit node activity confirmed. This IP routes anonymized traffic, commonly exploited for:

• Command and control communications
• DDoS attack amplification
• Credential stuffing operations
• Malware distribution

Blacklist Status: Listed on 1 DNS blacklist of 8 total lists checked

Risk Persistence: Single threat observation event; not persistently malicious

## Historical Activity

Analysis of 45 historical observations reveals consistent network behavior patterns. Recent observations (July 30-31, 2026) show stable operator scores of 0.1304 with minimal DNSSEC and CAA flags. No significant degradation or escalation in threat signals detected over the observation window.

## Neighborhood Analysis

The 180.149.45.0/24 subnet demonstrates:

• Abuse Density: 1.0
• Classification: Mostly clean
• Active Siblings: 1
• Threat Siblings: 1

Low neighborhood abuse density suggests this is an isolated malicious endpoint rather than part of a coordinated botnet.

## Recommended Actions

Access Control:

• Implement enhanced verification for anonymous traffic sources
• Consider blocking at perimeter if business requires

Monitoring:

• Increase logging verbosity for traffic from this IP
• Review recent activity patterns for anomalies

Firewall Implementation:

```bash

# iptables

iptables -A INPUT -s 180.149.45.21 -j DROP

# nftables

nft add rule inet filter input ip saddr 180.149.45.21 drop

# Nginx

deny 180.149.45.21;

# Cloudflare WAF

Action: Block — IPDebrief risk score 66

Expression: ip.src eq 180.149.45.21

# AWS WAF

Addresses: 180.149.45.21/32

Description: IPDebrief risk 66

```

## Intelligence Assessment

This IP represents a moderate-risk Tor exit node operating from a German residential/enterprise network. The combination of Tor routing and self-signed TLS certificates suggests potential use for anonymized malicious activity. While the subnet shows low overall abuse density, defensive measures are recommended given the confirmed Tor exit node status.

Priority: Medium

Action: Monitor or block based on organizational risk tolerance for Tor traffic

Retention: Maintain intelligence for 90-day correlation window

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.