188.116.36.143📋 Copy

# IP Intelligence Briefing: 188.116.36.143/32

## Executive Summary

IP address 188.116.36.143 presents a Low Risk profile with an overall risk score of 25. While classified as a Tor exit node provider, the IP demonstrates minimal malicious activity indicators and is listed on multiple DNS blacklists. No immediate threat indicators were observed across the full intelligence dataset.

---

## Ownership & Network Classification

• ASN: 60117
• Organization: Ali Al-Attiyah
• Netname: AE-SAILORHOST-20090529
• CIDR Block: 188.116.36.0/24
• Network Classification: Provider (Tor Exit Nodes)
• Registration RIR: RIPE

---

## Geolocation Analysis

• Primary Location: Romania (RO), coordinates 45.94°N, 24.97°E
• Timezone: Europe/Bucharest
• Geolocation Confidence: Consensus confirmed across multiple sources (geoPlausible: true)
• RTT Metrics: Minimum 3.4ms, Average 100.2ms across 5 probes

Anomaly Note: Recent network observation traced via Cogentco transit infrastructure through London, UK (LHR) during 2026-07-30T20:29:13 UTC, suggesting routing variation or potential geo-spoofing.

---

## Threat Indicators

---

## Service Footprint

• HTTP (80/tcp): Open, Apache/2.4.58 (Ubuntu)
• HTTPS (443/tcp): Open
• SSH (22/tcp): Open, OpenSSH_9.6p1 Ubuntu-3ubuntu13.18

TLS Certificate Analysis:

• Issuer: CN=www.lwnjujb7nmowbl.com
• Subject: CN=www.k75ext2edpq.net
• Assessment: Self-signed certificate with non-standard domain naming pattern

---

## Network Neighborhood Assessment

• Subnet: 188.116.36.0/24
• Abuse Density: 0 (Clean)
• Total Siblings: 2
• Active Siblings: 1
• Threat Siblings: 0
• Neighbor Risk Profile: Single neighbor (188.116.36.169) with matching risk score of 25

---

## Temporal Analysis

• Observation Count: 23 total signals over monitoring period
• Ownership Stability: 0 changes recorded
• Threat Observation Count: 0
• Persistent Malicious Activity: False
• Route Stability: False (route changes observed within 30-day window)

---

## Recommended Actions

• Firewall/IPS Rules: No specific blocking rules recommended at current risk level
• Monitoring: Continue passive monitoring; maintain alerting on port 22 (SSH) and 443 (HTTPS) traffic
• Geolocation Verification: Investigate routing discrepancy between Romania (profile) and UK (observation) paths

---

## Intelligence Assessment

The IP address operates within a low-risk subnet with minimal abuse indicators. The Tor exit node classification combined with DNS blacklist listings suggests potential for abuse, though current risk scoring indicates limited active threat. The suspicious TLS certificate domain patterns warrant continued monitoring. No immediate threat mitigation required; standard network hygiene practices apply.

Classification: LOW RISK — Monitor

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.