192.159.99.180📋 Copy

# IP Intelligence Briefing: 192.159.99.180/32

Classification: HIGH RISK – Tor Exit Node

Report Date: [Current Date]

Assigned Risk Score: 80/100

---

## Executive Summary

IP 192.159.99.180 is a high-risk Tor exit node operated by 1337 Services GmbH (ASN 210558). The IP exhibits classic anonymization network characteristics with active blacklist listings and RTT geolocation anomalies. Immediate defensive measures recommended due to elevated risk profile.

---

## Key Risk Indicators

---

## Technical Profile

Ownership & Registration

• Organization: 1337 Services GmbH
• Network: LEET-192-159-99-0
• ASN: 210558
• RIR: RIPE/NCC
• CIDR: 192.159.99.0/24

Geolocation Anomaly Detected

• Reported Location: Netherlands (NL)
• City: London (inconsistent with NL)
• RTT Validation: 25ms vs minimum possible 119.3ms for 5965km distance
• Status: Spoofed geolocation confirmed

Network Services

• Open Ports: TCP/22 (SSH-2.0-OpenSSH_9.2p1 Debian)
• TLS Certificate: None
• HTTP Services: None detected

---

## Threat Timeline

The IP has been observed 92 times since monitoring began. Recent activity (2026-07-21) shows:

• Consistent high-severity blacklist listings across 8 DNSBLs
• 5/8 active listings in recent observations
• Max severity rated: High
• Observation pattern: Multiple detections within minutes, indicating persistent malicious activity

---

## Network Context

Subnet Analysis: 192.159.99.0/24

• Abuse Density: 12.5% (0.125)
• Subnet Classification: Mostly clean
• Inherited Risk Score: 2/100
• Total /24 Siblings: 8
• Active Siblings: 5
• Threat Siblings: 1

Neighbor Risk Distribution

• High Risk: 0
• Medium Risk: 1 (192.159.99.38, score 40)
• Low Risk: 6 (scores 0-25)

Relationships

• 87 total relationships identified
• All relationships point to same network (LEET-192-159-99-0)
• No external organizational or hostname associations

---

## Recommended Actions

Immediate (Critical)

1. Block at perimeter firewall using provided rules for iptables, nftables, pfSense, Cloudflare WAF, and AWS WAF

2. Increase logging verbosity for traffic from this subnet

3. Review recent activity within the last 24 hours

Access Control (Medium)

• Implement enhanced verification for anonymous traffic
• Consider reputation-based filtering for Tor exit node ranges

Monitoring

• Add 192.159.99.180 to threat intelligence watchlist
• Monitor for correlation with other Tor exit nodes in the same /24

---

## Firewall Rules

```bash

# iptables

iptables -A INPUT -s 192.159.99.180 -j DROP

# nftables

nft add rule inet filter input ip saddr 192.159.99.180 drop

# nginx

deny 192.159.99.180;

```

---

## Conclusion

IP 192.159.99.180 presents a confirmed high-risk threat profile as a Tor exit node with active blacklist listings and geolocation spoofing. The subnet shows minimal contamination (12.5% abuse density), but the IP itself warrants immediate blocking and monitoring. No evidence of persistent malicious campaigns or organizational associations beyond the hosting provider.

Recommended Priority: Block immediately, monitor for activity patterns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.