201.3.225.29📋 Copy

# IP Intelligence Briefing: 201.3.225.29

Classification: Moderate Risk (Score: 40/100)

Analysis Date: Current

Prepared For: SOC Analyst Team

---

## Executive Summary

IP 201.3.225.29 is a moderately risky endpoint operating under ASN 48031 (IPBNB LLC). The IP is classified as a Tor exit node and hosts web/SSH services. Network analysis reveals elevated abuse density within the 201.3.225.0/24 subnet, with three additional threat-sibling IPs identified. Recommended action: Block at perimeter.

---

## Network Classification & Ownership

---

## Threat Indicators

• Risk Score: 40/100 (Moderate)
• Control Plane: Operator score 0.1304 (Minimal)
• DNSBL Listed: 2/8 lists
• Tor Exit Node: Yes
• Known Attacker: No
• Spam Source: No
• TLS Certificate: Self-signed; issuer CN=www.jcbl5tfmz5wrvvyvger4.com; subject CN=www.t25lqspzhx.net

---

## Service Exposure

PTR Hostname: vm23379.bit.hosting

---

## Neighborhood Analysis (201.3.225.0/24)

• Subnet Abuse Density: 0.3 (Moderate)
• Total Siblings: 10
• Threat Siblings: 3
• Risk Distribution: 0 High, 4 Medium, 5 Low

Elevated-Risk Neighbors:

---

## Observation History

• Total Observations: 23 signals over recent period
• Recent Signals: Multiple operator signals labeled "Minimal" (score 0.15)
• Persistence: No persistent malicious behavior observed
• Threat Persistence Days: 0

---

## Relationship Graph

• Network Association: IPBNB-LLC (multiple same-network relationships)
• DNS Association: vm23379.bit.hosting (primary hostname)

---

## Recommended Actions

Block the following IP at perimeter security devices:

```bash

# iptables

iptables -A INPUT -s 201.3.225.29 -j DROP

# nftables

nft add rule inet filter input ip saddr 201.3.225.29 drop

# nginx

deny 201.3.225.29;

# pfSense

201.3.225.29/32

# Cloudflare WAF

{"description":"Block 201.3.225.29 — IPDebrief risk score 40","action":"block","filter":{"expression":"ip.src eq 201.3.225.29"}}

# AWS WAF

{"Addresses":["201.3.225.29/32"],"Description":"IPDebrief risk 40"}

```

---

## SOC Analyst Notes

1. Tor Exit Node Classification: This IP is flagged as a Tor exit node, which may be utilized for anonymity-based attacks or traffic exfiltration.

2. Subnet Correlation: The 201.3.225.0/24 subnet shows moderate abuse density. Monitor the three elevated-risk neighbors (201.3.225.26, 201.3.225.20, 201.3.225.25) for correlated activity.

3. Certificate Anomalies: TLS certificate uses cryptic domain names typical of malicious infrastructure. No legitimate service associated with these domains.

4. Geographic Inconsistency: IP registered in Poland but geolocation suggests Stockholm. Further investigation recommended if this discrepancy correlates with threat activity.

5. Historical Persistence: No evidence of persistent malicious behavior. IP shows mixed signals with some "Minimal" operator ratings.

Priority: Medium — Block IP and monitor subnet neighbors for lateral threat activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.