201.3.225.25📋 Copy

# IP Intelligence Briefing: 201.3.225.25/32

Classification: HIGH RISK – Tor Exit Node Infrastructure

Date: Analysis completed based on latest available data

Risk Score: 70/100

## Executive Summary

IP 201.3.225.25 is classified as a Tor exit node provider operating under ASN 48031 (IPBNB Abuse Contact, netname: IPbnb-LLC). The IP shows Tor exit node indicators and is listed on 1 DNSBL. This classification indicates the IP is used as an endpoint for anonymized Tor traffic, which may facilitate malicious activity or legitimate privacy concerns.

## Technical Profile

Network Attribution:

• ASN: 48031
• Organization: IPBNB Abuse Contact / IPbnb-LLC
• CIDR Block: 201.3.225.0/24
• RIR: LACNIC (Latin America)
• Geolocation: Poland (PL) – Stockholm coordinates reported with 400km accuracy radius

Service Exposure:

• Port 443/TCP (HTTPS): Active
• Port 22/TCP (SSH): Active (SSH-2.0-OpenSSH_10.2p1 Ubuntu-2ubuntu3.5)
• TLS Configuration: TLS 1.3, cipher suite TLS_AES_256_GCM_SHA384
• DNS PTR: vm23367.bit.hosting

## Threat Indicators

Positive Identifiers:

• Tor exit node indicators confirmed
• DNSBL listing: 1 list
• Blacklist count: 1

Negative Identifiers:

• None (not classified as known attacker or spam source)

## Temporal Analysis

Recent observation history (July 29, 2026) shows:

• Connection attempts and TLS certificate validation activity
• Ownership resolution signals from lacnic RIR
• Geolocation signals pointing to Poland
• No persistent malicious behavior detected (threatPersistenceDays: 0)

## Neighborhood Context

Subnet 201.3.225.0/24 analysis:

• Total siblings: 9 IPs
• Abuse density: 0%
• Risk distribution: 1 high-risk, 8 low-risk
• Neighbor 201.3.225.20 also shows elevated risk (score 70)

## Recommended Actions

Access Control:

```bash

# Block at perimeter firewall

iptables -A INPUT -s 201.3.225.25 -j DROP

nft add rule inet filter input ip saddr 201.3.225.25 drop

```

Web Server Protection:

```nginx

# If using nginx

deny 201.3.225.25;

```

Cloud WAF Rules:

• Cloudflare WAF: Block IP with expression `ip.src eq 201.3.225.25`
• AWS WAF: Add to whitelist block with address `201.3.225.25/32`

Monitoring:

• Increase logging verbosity for traffic from this subnet
• Monitor for patterns suggesting Tor-based command and control
• Review SSH connection attempts from this IP

## Analyst Notes

The IP's classification as a Tor exit node does not automatically indicate malicious intent, but requires heightened scrutiny. The IP's service classification as "Web Server" combined with SSH access suggests potential for abuse. Consider allowing traffic only if legitimate business justification exists, and implement enhanced monitoring. The subnet's low abuse density (0%) suggests this may be an isolated elevated-risk IP rather than part of a broader malicious campaign.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.