185.123.53.89📋 Copy

INTELLIGENCE BRIEFING: IP 185.123.53.89/32

EXECUTIVE SUMMARY

IP address 185.123.53.89 operates as a Tor exit node with elevated risk profile (70/100). The IP is registered to BlueVPS (EE-BLUEVPS-20200316) within the 185.123.53.0/24 subnet in London, UK. No active services are detected on the endpoint.

---

TECHNICAL PROFILE

• Risk Score: 70/100 (High Risk)
• ASN: 62005 (mnt-ee-bluevps-1)
• Organization: BlueVPS Ltd. (EE-BLUEVPS-20200316)
• Location: London, Great Britain (RIPE)
• Network Classification: Tor Exit Nodes / Firewalled
• Services Detected: None (all ports closed)

THREAT INDICATORS

• Tor exit node confirmed
• Listed on 1 DNS blacklist (of 8 total threat feeds)
• No persistent malicious behavior observed
• Single threat observation recorded (non-persistent)
• Route stability: 1 change in 30-day period

NETWORK CONTEXT

• Subnet Abuse Density: Moderate (1/256 IPs flagged)
• Related Threat IPs: 1 sibling IP identified in /24
• External Correlations: None detected (isolated to local network)
• DNSSEC: Valid
• BGP Path: 6939 62005

---

OBSERVATION HISTORY (27 Observations)

Most recent signals from 2026-07-29 show stable Tor exit node classification with minimal operator score (0.1304). No escalation in threat severity observed over monitoring period.

---

RECOMMENDED ACTIONS

Access Control:

• Consider enhanced verification for anonymous traffic originating from this IP
• Implement rate limiting for Tor-related traffic patterns

Logging/Monitoring:

• Increase logging verbosity for traffic from this subnet
• Review recent activity for anomalous patterns (port scanning, brute force attempts)

Blocking Rules:

```bash

# iptables

iptables -A INPUT -s 185.123.53.89 -j DROP

# nftables

nft add rule inet filter input ip saddr 185.123.53.89 drop

# nginx

deny 185.123.53.89;

# pfSense

185.123.53.89/32

# Cloudflare WAF

Block IP 185.123.53.89 — Risk score 70

# AWS WAF

Addresses: 185.123.53.89/32

Description: IPDebrief risk 70

```

---

ANALYST NOTES

This IP presents a moderate-to-high risk profile primarily due to Tor exit node classification. While no active services are running, the IP should be blocked at perimeter layers. Monitor the 185.123.53.0/24 subnet for coordinated activity given the presence of one additional threat sibling IP.

*Data timestamp: 2026-07-29*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.