185.246.191.53📋 Copy

IP Intelligence Briefing: 185.246.191.53

*Last Updated: 2026-06-13*

1. Risk Profile

• Risk Score: 70 (High Risk)
• Threat Indicators: Identified as a Tor exit node, listed in 1 DNSBL (darklist).
• Network Role: Single-service host (SSH on port 22).
• Ownership: Registered to FlokiNET NOC (ASN 200651, Finland).
• Geolocation: Finland (FI), no city/region specified.

2. Threat Observations

• Tor Exit Node: Confirmed via signal analysis; associated with anonymized traffic.
• DNSBL Listing: Flagged in 1 DNSBL, suggesting potential misuse.
• Network Behavior:

- Ping latency: 121–127 ms (distance ~2,000 km).

- No DNSSEC validation issues reported.

- No TLS/HTTP services detected.

3. Historical Trends

• Recent Activity:

- Tor exit indicators observed on 2026-06-13.

- No persistent malicious activity or ownership changes noted.

• Stability: Route stability score is low (0.13), indicating potential network instability.

4. Network Relationships

• Subnet: 185.246.191.0/24 (no abuse density reported).
• Shared Network: Linked to IS-FLOKINETEHF-20250812 (FlokiNET NOC).
• Neighbors: No neighboring IPs found in the subnet.

5. Recommendations

• Monitoring: Track SSH traffic and Tor exit node activity.
• Mitigation: Consider blocking Tor exit nodes in firewall rules (e.g., iptables, nftables).
• Investigation: Validate if the IP is used for illicit activities (e.g., C2, data exfiltration).

6. Context

• The IP’s Tor association and DNSBL listing suggest potential misuse, despite no direct malicious campaigns.
• FlokiNET NOC’s ownership is legitimate, but the IP’s role as a Tor exit node warrants closer scrutiny.

Next Steps: Correlate with internal threat intelligence for further context.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.