185.243.218.231📋 Copy

IP Intelligence Briefing: 185.243.218.231

Date: 2026-06-09

---

**1. Core Risk Profile**

• Risk Score: 70 (High Risk)
• Threat Indicators:

- Tor exit node observed (100% confidence).

- DNSBL listing (1/8 lists).

• Ownership:

- ASN: AS56655 (GIGAHOST, Norway).

- Geolocation: Sandefjord, Vestfold, Norway (latitude 59.9452, longitude 10.7559).

• Network Role:

- Identified as a Tor exit node.

- Services: HTTP/HTTPS (ports 80, 443, 8443) with nginx server banner.

- TLS certificate: Issued to `www.a7a6hwrfljclqb6wt.com`, subject `www.fcyahto422cu.net` (self-signed).

---

**2. Temporal Observations**

• First Seen: 2026-06-09 (1 observation).
• Signal Trends:

- Consistent Tor exit node activity.

- No persistent malicious behavior detected.

---

**3. Network Relationships**

• Subnet: 185.243.218.0/24 (GIGAHOST-NET).
• Neighbors (6 total):

- 5 IPs with low risk (scores 25–70).

- 1 IP (185.243.218.225) with elevated risk (66).

• Subnet Abuse Density: 0% (clean).

---

**4. Threat Context**

• Tor Exit Node: High-risk association with Tor network, often used in covert communications or C2 operations.
• SSL Certificate: Self-signed certificate with suspicious domain names (potential phishing or MITM risks).
• DNS Security: DNSSEC validated, but no CAA records detected.

---

**5. Actionable Insights**

• SOC Recommendation:

- Block traffic from this IP unless explicitly required for Tor-related operations.

- Monitor subnets (185.243.218.0/24) for Tor exit node activity.

- Investigate the TLS certificate’s origin to confirm legitimacy.

• Firewall Rules:

- Implement deny rules for this IP in iptables/nftables.

- Add to Cloudflare/AWS WAF blocking lists if applicable.

---

Conclusion: This IP is a Tor exit node with high-risk indicators. While the subnet appears clean, its association with Tor necessitates close monitoring for potential misuse in cyberattacks.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.