194.163.136.187📋 Copy

IP Intelligence Briefing: 194.163.136.187

*Generated via IPDebrief Threat Intelligence Platform*

---

**1. Core Profile**

• Risk Score: 59/100 (Moderate Risk)
• Network Role: Tor Exit Node (confirmed via BGP and DNS analysis)
• Ownership: Registered to Johannes Selg (AS: 51167, RIPE)
• Geolocation: Düsseldorf, Germany (51.17°N, 10.45°E)
• Threat Indicators:

- Tor exit node activity detected

- 1 DNS record linked to `contaboserver.net` (hosted domains: 0)

---

**2. Observation History**

• Last 30 Days:

- Persistent Tor exit node activity (1 observation)

- No significant changes in risk score or network behavior

- DNS resolution confirmed for `vmi3113811.contaboserver.net`

---

**3. Network Relationships**

• Linked Entities:

- Hostname: `vmi3113811.contaboserver.net` (DNS PTR record)

- Network: Subnet `194.163.136.0/24` (abuse density: 0.67)

• Neighbor Analysis:

- Subnet contains 3 IPs (2 active, 1 flagged as low-risk)

- No immediate lateral threats detected

---

**4. Security Actions**

Recommended Mitigations:

1. Block IP via Firewall:

- `iptables -A INPUT -s 194.163.136.187 -j DROP`

- `nft add rule inet filter input ip saddr 194.163.136.187 drop`

2. Monitor Anonymized Traffic:

- Tor exit nodes may mask malicious activity (e.g., C2, exfiltration).

3. Verify DNS Associations:

- Investigate `contaboserver.net` for potential hosting abuse.

---

**5. Risk Summary**

• Immediate Threat: Low (neighbors have 0 abuse density).
• Long-Term Concern: Tor exit node status increases risk of anonymized attacks.
• Owner Context: Johannes Selg has no known abuse history (RIPE records).

Next Steps:

• Correlate with internal logs for anomalous traffic patterns.
• Validate DNS and BGP data for upstream provider risks.

---

*Generated on 2026-06-15 | IPDebrief*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.