192.42.116.65📋 Copy

IP Intelligence Briefing: 192.42.116.65

Date: June 7, 2026

---

**Core Profile**

• Risk Score: 80 (High Risk)
• Network Role: Tor Exit Node (confirmed via BGP and TLS analysis)
• Geolocation: Amsterdam, Netherlands (52.13°N, 5.29°E)
• Ownership: AS1101 (surfnet bv, ARIN-registered)
• Threat Indicators:

- Tor exit node activity detected

- DNSSEC validation confirmed

- 5 DNSBL listings (potential abuse risk)

---

**Observation History**

• Recent Activity (Last 7 Days):

- 63 observations logged, with 27 high-risk neighbors in the 192.42.116.0/24 subnet.

- TLS 1.3 service detected (AES-256-GCM cipher suite).

- No HTTP server banners or email authentication records.

• Trend: Stable risk profile; no significant changes in threat signals.

---

**Network Relationships**

• Linked Entities:

- Tor exit node network (192.42.116.65/24)

- AS1101 (surfnet bv)

- 150+ related IPs in the same subnet (27 high-risk, 40 medium-risk).

• Subnet Abuse Density: 40.3% (high risk).

---

**Neighbor Analysis**

• Subnet: 192.42.116.0/24
• Risk Distribution:

- 27 IPs with high risk scores (80+).

- 40 IPs with medium risk scores (60–79).

• Notable Neighbors:

- 192.42.116.12 (risk score 80)

- 192.42.116.13 (risk score 80)

- 192.42.116.14 (risk score 70)

---

**Actionable Insights**

1. Threat Context:

- The IP is a Tor exit node, which is inherently associated with privacy and anonymity but also frequently used in malicious activities (e.g., hiding C2 traffic, data exfiltration).

- High-risk neighbors in the subnet suggest potential collusion or shared infrastructure for abuse.

2. Recommendations:

- Monitor Traffic: Investigate traffic originating from or to this IP, as it may be part of a larger Tor-based attack chain.

- Subnet-Level Mitigation: Consider rate-limiting or blocking the 192.42.116.0/24 subnet if suspicious activity is detected.

- DNSBL Checks: Verify if the IP is listed on additional DNSBLs beyond the 5 currently noted.

3. SOC Prioritization:

- Flag as high-risk for further analysis.

- Correlate with other Tor exit nodes in the same subnet for potential campaign linkage.

---

End of Briefing

*Generated via IPDebrief intelligence tools. All data reflects observed signals as of June 7, 2026.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.