198.167.206.191📋 Copy

# IP Intelligence Briefing: 198.167.206.191

Date: Current

Analyst: SOC Intelligence

Classification: Defensive Security

---

## Executive Summary

IP address 198.167.206.191 is classified as Low Risk with a risk score of 0. However, the IP is classified as a Tor Exit Node and is currently firewalled with no active services. The neighborhood exhibits minimal abuse density (0), with 30 low-risk and 2 medium-risk siblings across the 198.167.206.0/24 subnet.

---

## Profile Overview

Risk Assessment

• Reputation: Low Risk
• Risk Score: 0
• Provider Score: 0
• Authority Score: 0
• Stability Score: 0

Geolocation

• Country: United States (US)
• Region: US-NJ (New Jersey)
• City: Newark
• Timezone: America/New_York
• Geo Source Count: 1
• Geo Consensus: True

Network Classification

• Network Role: Tor Exit Nodes
• Infrastructure Type: Unknown
• Cloud/CDN/Proxy: False
• Services Status: Firewalled / No Services
• Open Ports: None detected

Threat Indicators

• Known Attacker: False
• Spam Source: False
• Tor Exit Node: True
• Blacklist Count: 0
• Abuse Confidence Score: Null

---

## Observation History Analysis

Total Observations: 13 signals

Key Temporal Signals:

• 2026-07-28 23:01:49: Domain resolution to njalla.net observed
• 2026-07-28 23:01:52: Blacklist listings detected (8 total lists, 0 active listings)
• 2026-07-28 23:02:13: DNSSEC evaluation signal (Basic level, operator score: 0.26)
• 2026-07-28 23:02:21: Geolocation signal indicating Sweden (SE) at 59.3247° latitude with 0.70 confidence

Temporal Patterns:

• Ownership changes: 0
• Threat persistence days: 0
• Threat observation count: 0
• Persistently malicious: False

---

## Neighborhood Intelligence

Subnet: 198.167.206.0/24

Total Siblings: 34

Risk Distribution

• High Risk: 0 IPs
• Medium Risk: 2 IPs (198.167.206.133, 198.167.206.158 with riskScore: 59)
• Low Risk: 30 IPs

Notable Neighbors

Abuse Density

• Subnet Abuse Density: 0
• Inherited Risk: 0

---

## Relationship Graph

Connected Entities: None

• No relationships detected with subnets, hostnames, organizations, or certificates
• No correlated IPs in the campaign analysis

---

## Control Plane Data

• Route Stability: False
• BGP Prefix: Null
• RPKI State: Null
• Route Changes (30d): 0
• DNSSEC Valid: False
• DNSBL Listed Count: 0
• Traceroute: 15 hops, first hop RTT: 0.1ms, last hop RTT: 98.7ms
• Transit Network: Comcast

---

## Behavioral Analysis

• Honeypot Hits: 0
• Enumeration Strikes: 0
• WAF Violations: 0
• Total Incidents: 0
• Auto-Banned: False
• Active Attacker: False

---

## Recommended Actions

Current Status: No immediate blocking required. IP shows no active malicious behavior.

Monitoring Recommendations:

1. Monitor for service activation (currently firewalled with no open ports)

2. Track geolocation consistency (current signals show US/NJ, but history indicates Sweden)

3. Watch for neighbor activity from medium-risk IPs (198.167.206.133, 198.167.206.158)

4. Verify Tor Exit Node classification accuracy

Firewall Considerations:

• No specific firewall rules recommended at this time
• Consider allowing if legitimate Tor traffic is expected
• Monitor for outbound connections from this IP

---

## Threat Narrative

IP 198.167.206.191 is a Tor Exit Node located in the Newark, NJ subnet (198.167.206.0/24). The subnet demonstrates low abuse density with no high-risk neighbors and minimal medium-risk activity. The IP has been observed resolving to njalla.net, which is commonly associated with Tor network infrastructure. Current behavioral indicators show no active attacks, enumeration attempts, or WAF violations. The geolocation discrepancy (US registration vs. Sweden observation) is consistent with Tor routing patterns where exit nodes may route through different geographic regions. No relationships exist with other malicious entities or campaigns. The IP remains in a low-risk state with no observed malicious persistence.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.