185.220.101.159📋 Copy

IP Intelligence Briefing: 185.220.101.159

Date: 2026-06-17

---

**1. Core Profile**

• Risk Score: 59 (Moderate Risk)
• Ownership: Owned by CIA TRIAD SECURITY LLC (ASN 60729).
• Geolocation: Registered to Brandenburg, Germany (latitude/longitude unspecified).
• Threat Indicators:

- Tor exit node detected.

- Observed in 1 Tor exit-related DNS record (`tor-exit-159.relayon.org`).

• Network Role: Identified as a Tor exit node (no services or hosting detected).

---

**2. Observation History**

• Recent Activity (Last 5 Days):

- Consistent signals (55 total observations) with stable risk scores.

- Tor exit indicators observed across multiple timestamps (June 16–17, 2026).

• Risk Trends: No significant spikes or declines in risk scores.

---

**3. Relationships & Connections**

• Linked Entities:

- Network: "RELAYON" (likely a hostname or related subnet).

- ASN: 60729 (CIA TRIAD SECURITY LLC).

• BGP Data:

- AS Path: `6939 29670 60729` (route stability confirmed).

- RPKI valid, no IRD violations.

---

**4. Neighborhood Analysis**

• Subnet: `185.220.101.0/24` (142 total IPs).
• Risk Distribution:

- 1 high-risk neighbor, 97 medium-risk, 2 low-risk.

- Abuse density: 2.96% (moderate risk concentration).

• Notable Neighbors:

- IPs with risk scores ≥50 (e.g., 185.220.101.3, 185.220.101.4).

---

**5. Threat Context**

• Tor Exit Node: Commonly used for anonymity but often associated with illicit activities (e.g., malware distribution, censorship circumvention).
• Ownership Concerns: CIA TRIAD SECURITY LLC’s involvement raises questions about legitimacy or potential misuse.
• Neighbor Risk: Presence of high-risk IPs in the subnet suggests possible lateral movement or shared infrastructure risks.

---

**6. Recommendations**

1. Monitor Traffic: Block or monitor Tor exit node traffic if the network is deemed high-risk.

2. Investigate Ownership: Verify CIA TRIAD SECURITY LLC’s legitimacy and check for historical abuse reports.

3. Subnet Review: Prioritize scrutiny of neighboring IPs with elevated risk scores (e.g., 185.220.101.3).

4. Update Firewalls: Consider adding rules to restrict Tor exit node access if the network is classified as hostile.

Note: This IP is part of a Tor network, which inherently poses anonymity challenges. Further analysis of associated domains (e.g., `relayon.org`) is recommended.

---

*Generated via IPDebrief intelligence tools. Data accurate as of 2026-06-17.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.