185.225.226.63📋 Copy

# Intelligence Briefing: 185.225.226.63/32

## Executive Summary

IP address 185.225.226.63 is a Tor exit node hosted in Ukraine with a moderate risk score of 59/100. The IP operates as a web server with HTTP, HTTPS, and SSH services enabled. Tor exit node classification indicates potential use for anonymizing malicious traffic, warranting enhanced monitoring and access controls.

## Threat Profile

Classification: Tor Exit Node Provider

Risk Score: 59 (Moderate Risk)

Geolocation: Kyiv, Ukraine (UA)

ASN: 207560

Organization: Zubritska Valeriia Nikolaevna

Network: 185.225.226.0/24

Threat Indicators:

• Tor exit node indicators confirmed
• Listed on 1 DNS blacklist of 8 total lists checked
• Abuse confidence score elevated due to Tor classification
• No association with known attacker campaigns

Network Role: Web Server hosting Tor exit functionality

## Technical Observations

Open Ports:

• TCP/80 (HTTP)
• TCP/443 (HTTPS)
• TCP/22 (SSH - OpenSSH_10.0p2 Debian)

DNS Resolution:

• Reverse DNS: 63.226.225.185.vikhost.com
• Forward resolution: Unconfirmed (vikhost.com)
• TLS Certificate: Subject CN=www.4ltgdvdgsjc4.net, Issuer CN=www.3rx7fm3guic6.com

Routing Status: Route stability flagged as unstable with 1 route change in 30 days

## Neighborhood Analysis

The /24 subnet (185.225.226.0/24) shows elevated activity with 3 active sibling IPs:

• 185.225.226.42 (Risk: 59)
• 185.225.226.62 (Risk: 59)
• 185.225.226.63 (Risk: 59)

All three neighbors share the same risk profile, suggesting coordinated Tor exit infrastructure deployment within this subnet.

## Historical Context

32 observations recorded since last analysis. Routing signals remain stable with consistent ASN 207560 ownership. No significant changes in geolocation, threat classification, or service configuration detected over the observation period.

## Recommended Actions

Immediate (High Priority):

1. Block at perimeter firewall level using provided rulesets for iptables, nftables, pfSense, Cloudflare WAF, and AWS WAF

2. Increase logging verbosity for all traffic from this IP and the entire /24 subnet

Enhanced Monitoring (Medium Priority):

3. Implement enhanced verification for anonymous traffic patterns

4. Monitor for brute force attempts on SSH (port 22)

5. Review web application logs for Tor exit node activity patterns

Firewall Rule Example:

```bash

# Drop traffic from this IP

iptables -A INPUT -s 185.225.226.63 -j DROP

```

## SOC Analyst Notes

Tor exit nodes are commonly exploited for:

• DDoS attack origination
• Phishing and credential harvesting
• Malware command and control
• Spam distribution

While this IP is not classified as a known attacker, the Tor exit node designation warrants defensive blocking or at minimum strict rate limiting. Consider implementing reputation-based filtering for all Tor exit IPs in the 185.225.226.0/24 range.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.