185.252.232.218📋 Copy

IP Intelligence Briefing: 185.252.232.218

*Generated via IPDebrief Threat Intelligence Platform*

---

**Core Risk Profile**

• Risk Score: 59 (Moderate Risk)
• Threat Indicators:

- Identified as a Tor exit node (high-risk association).

- Observed in 1 DNS resolution (`vmi1347637.contaboserver.net`).

• Network Classification:

- Provider: Tor Exit Node (IPv4 /24 subnet).

- Geolocation: Germany (Lauterbourg, 51.17°N, 10.45°E).

- ASN: 51167 (Johannes Selg).

---

**Threat Observations**

• Historical Signals:

- Consistent "Moderate" risk classification across 54 observations (last 30 days).

- No spikes in malicious activity detected.

• Tor Exit Node:

- SSH service active (port 22, OpenSSH 8.4).

- Tor exit nodes are often used for covert communication or as entry points for attacks.

---

**Network Relationships**

• DNS Associations:

- Linked to `vmi1347637.contaboserver.net` (no abuse indicators).

• Subnet Neighbors:

- 185.252.232.0/24 subnet: 3 total IPs, 2 active.

- Risk Distribution: 0 high-risk, 0 medium-risk, 2 low-risk IPs.

---

**Actionable Insights**

1. Monitor Tor Exit Traffic:

- Block or closely inspect traffic originating from or passing through this IP, as Tor exit nodes are frequently associated with illicit activities.

2. Investigate Hostname:

- Validate the reputation of `vmi1347637.contaboserver.net` for potential hosting provider ties or abuse.

3. Subnet Analysis:

- The subnet has low abuse density, but the IP’s Tor association warrants closer scrutiny.

---

Recommendation:

• Add this IP to a Tor exit node blocklist if not already present.
• Correlate with internal logs for signs of exploitation or data exfiltration.
• Reassess the subnet’s security posture given the presence of a Tor exit node.

*Generated on 2026-06-15 | Data sourced from IPDebrief intelligence feeds.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.