198.98.61.60📋 Copy

# IP INTELLIGENCE BRIEFING: 198.98.61.60/32

Classification: Moderate Risk (Score: 49/100)

Date: Analysis based on current IPDebrief data

Status: Active Tor Exit Node with Associated Infrastructure

---

## EXECUTIVE SUMMARY

IP 198.98.61.60 is a Tor exit node operated by FranTech Solutions (ASN 53667) in New York, US. The IP presents moderate risk due to its role as an anonymous traffic gateway, with 1 DNSBL listing and 1 observed blacklist hit. While not flagged as a known attacker, the Tor exit designation warrants traffic verification controls.

---

## OWNERSHIP & GEOLOCATION

• Organization: FranTech Solutions
• ASN: 53667
• Country: United States (NY)
• CIDR Block: 198.98.48.0/20 (BGP prefix origin)
• Geolocation Validation: Flagged implausible (RTT 18ms vs. minimum possible 119.7ms for stated distance of 5,987km)
• DNSSEC: Valid

---

## THREAT INDICATORS

Primary Threat: Anonymous traffic bypassing identity verification. SSH service (port 22) running OpenSSH_8.2p1 Ubuntu-4ubuntu0.11.

---

## NETWORK CONTEXT

• Subnet: 198.98.61.0/24
• Abuse Density: Low (0–1% range)
• Risk Distribution: 0 high/0 medium risk neighbors identified
• Relationships: 240+ associations with PONYNET-06 network infrastructure
• Route Stability: Stable (no changes in 30 days)

---

## OBSERVATION HISTORY

• Total Signals: 54 observations
• Recent Trend: Consistent minimal threat signals (0 raw score on multiple checks)
• Last Observation: 2026-06-27T15:35:58 UTC
• Threat Persistence: 0 days (transient activity pattern)

---

## RECOMMENDED ACTIONS

Implementable Rules:

• iptables: `iptables -A INPUT -s 198.98.61.60 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 198.98.61.60 drop`
• nginx: `deny 198.98.61.60;`
• Cloudflare WAF: Block IP with filter expression `ip.src eq 198.98.61.60`
• AWS WAF: Add to IPSet with CIDR `198.98.61.60/32`

---

## ANALYST NOTES

The IP is definitively classified as a Tor exit node, which is expected behavior for this infrastructure. The moderate risk score (49) reflects the inherent risk of anonymized traffic rather than malicious activity. SOC teams should:

1. Apply allow-listing if Tor traffic is required for legitimate operations

2. Apply rate-limiting or enhanced logging if blocking is not feasible

3. Monitor for abuse patterns associated with this subnet

4. Verify geolocation claims against known Tor exit node distributions

Status: Monitor — No immediate threat, but traffic should be verified for anonymity-related abuse.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.