201.3.225.28📋 Copy

## IP Intelligence Briefing: 201.3.225.28/32

Classification: MODERATE RISK | Date: 2026-07-30 | Analyst: IPDebrief Intelligence

---

Executive Summary

IP address 201.3.225.28 presents a moderate risk profile (score: 40) with classification flags indicating Tor exit node provider infrastructure. The IP is associated with IPbnb-LLC (ASN: 48031) within the 201.3.225.0/24 subnet and exhibits mixed abuse characteristics. While no active threat indicators were detected, the IP appears on 2 of 8 DNS blacklists with moderate neighborhood abuse density.

---

Ownership & Network Classification

Note: Geolocation validation flagged as implausible (geoPlausible: false). Coordinates reported as latitude 51.92, longitude 19.15, which may indicate data inconsistency.

---

Threat Assessment

• Risk Score: 40 (Moderate)
• Known Campaigns: None detected
• Blacklist Status: Listed on 2 of 8 DNSBLs
• Abuse Confidence: Null
• Known Attacker: False
• Spam Source: False

Threat Indicators: No active threat indicators currently associated with this IP.

---

Infrastructure & Services

DNS Resolution:

• PTR Hostname: vm23376.bit.hosting
• Forward Resolution: 1 record (vm23376.bit.hosting)
• Forward Confirmed: False (potential misconfiguration)

TLS Certificate: Certificate detected with issuer CN=www.3rjjmcuo6nzcefnzra.com and subject CN=www.zi2i323pqh5xyc.net. Certificate validity dates not available in current observation window.

---

Neighborhood Analysis (201.3.225.0/24)

• Total Siblings: 10
• Active Siblings: 10
• Threat Siblings: 3
• Abuse Density: 0.3 (30%)
• Subnet Classification: Mixed

High-Risk Neighbors Identified:

• 201.3.225.26: Risk Score 70
• 201.3.225.25: Risk Score 66
• 201.3.225.20: Risk Score 66

The subnet exhibits moderate abuse characteristics with three identified threat siblings.

---

Historical Observation

26 observations recorded across the monitoring period. Recent signals indicate:

• Operator score: 0.1304 (Minimal)
• No persistent malicious activity detected
• Route stability: Unstable (isRouteStable: false)
• Ownership changes: 0

---

Recommended Actions

Immediate Mitigation: Block the IP address at perimeter defenses.

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 201.3.225.28 -j DROP

# nftables

nft add rule inet filter input ip saddr 201.3.225.28 drop

# nginx

deny 201.3.225.28;

# pfSense

201.3.225.28/32

# Cloudflare WAF

{"description":"Block 201.3.225.28 — IPDebrief risk score 40","action":"block","filter":{"expression":"ip.src eq 201.3.225.28"}}

# AWS WAF

{"Addresses":["201.3.225.28/32"],"Description":"IPDebrief risk 40"}

```

Monitoring Priorities:

1. Monitor for increased activity from the 201.3.225.0/24 subnet

2. Watch for DNSBL additions or removals

3. Track route stability changes (currently unstable)

4. Monitor high-risk neighbor IPs (201.3.225.26, 201.3.225.25, 201.3.225.20)

---

Intelligence Notes

The IP's classification as a Tor exit node provider with moderate risk score, combined with unstable routing and presence on multiple DNSBLs, suggests this infrastructure may be utilized for legitimate purposes but carries inherent abuse potential. The mismatched TLS certificate and unconfirmed forward resolution warrant continued monitoring. No evidence of active malicious campaigns or known attacker associations at this time.

Confidence Level: Moderate (based on 26 historical observations and 31 relationship entities)

Recommendation: Implement blocking controls while maintaining surveillance on subnet-level activity patterns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.