212.86.116.26📋 Copy

# IP Intelligence Briefing: 212.86.116.26

## Executive Summary

The IP address 212.86.116.26 presents a Moderate Risk profile (Score: 59/100) with confirmed Tor exit node indicators. The address is associated with a Ukrainian infrastructure network (ASN 6698, UA-VSYS) and is classified as a Tor exit node provider, presenting potential anonymity-related risks for inbound traffic.

## Technical Profile

Network Attribution

• ASN: 6698 (Vyacheslav Smyrnov - UA-VSYS)
• Geolocation: Kyiv, Ukraine (UA)
• Subnet: 212.86.116.0/24
• Network Classification: Tor Exit Nodes

Service Exposure

• Open Ports: 22/SSH, 80/HTTP, 443/HTTPS
• DNS Resolution: dedicated.vsys.host (vsys.host)
• TLS Certificate: CN=www.3xmwssrnwimm5tlxsqd.com (subject: www.uupuxvbxky6zvc7jw.net)
• SSHP Banner: OpenSSH_10.0p2 Debian-7+deb13u4

Threat Indicators

• Tor Exit Node: Confirmed (isTor: true)
• Blacklist Count: 1 active listing
• DNSBL Listings: 1 of 8 total lists
• Route Stability: Unstable (1 route change observed in 30 days)
• Abuse Confidence: Not definitively classified as known attacker or spam source

## Historical Activity

The IP has generated 36 total observations in the monitoring database. Recent signal activity includes:

• Multiple Tor exit node indicator observations
• Blacklist listings with high severity ratings
• Network trace hops indicating 18-hop path resolution
• Operator score: 0.1304 (labeled "Minimal")

## Neighborhood Analysis

The /24 subnet (212.86.116.0/24) shows:

• Abuse Density: 1.0 (classified as "mostly_clean")
• Threat Siblings: 1 identified within subnet
• Active Siblings: 1

## Risk Assessment

The primary risk factor is the confirmed Tor exit node classification. Tor exit nodes are commonly used to anonymize malicious traffic, though they can also serve legitimate purposes. The moderate risk score (59/100) reflects this mixed-use profile. Route instability suggests potential infrastructure changes or temporary hosting arrangements.

## Recommended Actions

Immediate Mitigation

1. Access Control: Implement enhanced verification for traffic from this IP, particularly for authentication-sensitive services

2. Logging: Increase verbosity and retention for all traffic from 212.86.116.26

Firewall Rules

```

iptables: iptables -A INPUT -s 212.86.116.26 -j DROP

nftables: nft add rule inet filter input ip saddr 212.86.116.26 drop

nginx: deny 212.86.116.26;

Cloudflare WAF: Block IP (risk score 59/100)

AWS WAF: Add to blocklist (212.86.116.26/32)

```

SOC Monitoring Priorities

• Monitor for port 22 (SSH) scanning activity from this source
• Watch for unusual traffic patterns consistent with Tor-based command-and-control
• Track DNS queries to vsys.host and related domains

## Conclusion

This IP should be blocked or subjected to enhanced scrutiny depending on organizational risk tolerance. The Tor exit node designation warrants defensive blocking for systems requiring strict trust boundaries. Monitor the subnet 212.86.116.0/24 for correlated activity from the identified threat sibling.

---

*Intel generated from IPDebrief analysis. Review firewall rules in conjunction with organizational security policies.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.