194.26.141.206📋 Copy

# IP Intelligence Briefing: 194.26.141.206/32

Date: July 22, 2026

Classification: Low Risk / Tor Exit Node

Risk Score: 25 (0-100 scale)

---

## Executive Summary

IP address 194.26.141.206 is identified as a Tor Exit Node with a low-risk profile (score: 25). The address is geolocated to London, GB, though geolocation consistency is compromised. The subnet (194.26.141.0/24) shows clean classification with zero abuse density and no threat siblings. No open services are detected; the IP is firewalled with no active services exposed.

---

## Technical Profile

---

## Threat Assessment

Classification: Tor Exit Node

The IP is definitively classified as a Tor Exit Node based on network role identification. This classification indicates the address terminates Tor traffic and may be used for:

• Anonymized traffic relay
• Potential abuse as a proxy endpoint
• Tor-related scanning or C2 communications

Blacklist Status

• Total DNSBL Listings: 8
• Active Listings: 1
• Max Severity: High
• Campaign Correlation: 0 matches

Routing Stability

• Route Stable: False
• Route Changes (30d): 0
• RPKI State: Not evaluated
• IRR Consistency: Not evaluated

---

## Observation History

Total Observations: 13 signals tracked

Temporal Analysis

• Threat Persistence: 0 days
• Ownership Changes: 0
• Is Persistently Malicious: False
• Threat Observation Count: 0

---

## Geolocation Analysis

*Note: Geolocation data shows inconsistencies (Harjumaa is typically Estonia) but geoPlausible validation passed.*

---

## Network Neighborhood

No neighboring IPs or threat siblings detected within the /24 subnet.

---

## Relationships

Connected Entities: 0

• No associated hostnames
• No linked organizations
• No related certificates
• No subnet relationships documented

---

## Recommended Actions

Firewall Rules (iptables)

```bash

# Block Tor exit node traffic

iptables -A OUTPUT -d 194.26.141.206 -j DROP

iptables -A INPUT -s 194.26.141.206 -j DROP

```

Cloudflare WAF

```yaml

rules:

- action: block

expression: ip.src eq 194.26.141.206

description: "Block Tor Exit Node"

```

AWS WAF

```json

{

"Priority": 100,

"Statement": {

"IPSetReferenceStatement": {

"ARN": "arn:aws:wafv2:region:account-id:ipset/194.26.141.206"

}

},

"Action": "block",

"VisibilityConfig": {

"SampledRequestsEnabled": false,

"CloudWatchMetricsEnabled": true

}

```json

"Id": "194.26.141.206-tor-block"

}

```

SIEM Alert Rule (Splunk/ELK)

```

index=* src_ip=194.26.141.206

| eval risk_category="Tor Exit Node"

| eval severity="Medium"

| outputcsv

```

Detection Rules (YARA/Sigma)

```yaml

rule: Tor-Exit-Node-Detection

severity: medium

description: "Tor exit node outbound traffic detection"

sources:

- network_logs

- connection_logs

filters:

- dst_ip: 194.26.141.206

- dst_port: 9001-9050

- protocol: tcp

```

---

## Indicators of Compromise (IOCs)

---

## Mitigation Guidelines

Immediate Actions

1. Block outbound traffic to this IP at perimeter firewalls

2. Monitor inbound connections for potential reverse proxy abuse

3. Update IDS/IPS signatures for Tor traffic patterns

4. Add to threat feed distribution lists

Long-term Recommendations

1. Implement TLS inspection to detect encrypted Tor traffic

2. Monitor for beaconing patterns from this IP

3. Track reputation changes weekly via automated scanning

4. Coordinate with upstream providers if abuse patterns emerge

---

## Verification Checklist

• [ ] Confirmed Tor Exit Node classification via multiple sources
• [ ] Verified blacklist status across threat intelligence feeds
• [ ] Checked subnet for related malicious activity
• [ ] Validated geolocation accuracy
• [ ] Assessed routing stability and BGP anomalies
• [ ] Reviewed historical observation data for patterns

---

## Analyst Notes

This IP presents a contained threat profile. While classified as a Tor Exit Node (common for anonymity services), the lack of open services, clean neighborhood, and minimal operator score suggest low immediate risk. SOC teams should:

• Monitor for abuse complaints or reported incidents
• Track any reputation degradation over time
• Maintain blocklists for high-security environments

Status: Passive Monitoring Recommended

Next Review: 30 days or upon threat feed updates

---

*Generated by IPDebrief Intelligence Platform*

*Classification: DEFENSIVE SECURITY INTELLIGENCE*

*Distribution: SOC Team / Threat Intel Analysts*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.