213.111.147.9📋 Copy

# IP INTELLIGENCE BRIEFING: 213.111.147.9/32

## Executive Summary

IP address 213.111.147.9 is classified as a Tor Exit Node with a risk score of 66/100 (Moderate Risk). The address belongs to Sollutium Network Coordination Center (AMS-COLO) and is currently listed on 1 of 8 DNSBLs with high severity. Recent observation history shows persistent blacklist activity as of July 28, 2026.

## Risk Profile

• Risk Score: 66/100 (Moderate Risk)
• Network Classification: Tor Exit Node
• ASN: 43641 (Sollutium Network Coordination Center)
• CIDR Block: 213.111.147.0/24
• Geolocation: Poland (PL), Haarlem region (coordinates: 51.92N, 19.15E)
• DNSBL Status: Listed on 1 of 8 blacklist feeds

## Threat Indicators

• Tor Exit Node: Confirmed
• Blacklist Listings: 1 active listing (high severity)
• Observed Threats: Tor exit indicators detected
• Campaign Correlation: None identified
• Known Attacker Status: Not flagged

## Network Services

TLS Certificate Analysis: Mismatched certificate detected (issuer: CN=www.5iu4znljvk55fbufxj.com, subject: CN=www.skcnaq6lefl52k.net)

## Network Context

• Ownership: Sollutium Network Coordination Center
• Network Name: AMS-COLO
• RIR: RIPE
• PTR Hostname: dedicated.sollutium.com
• Route Stability: Unstable (1 route change in 30 days)
• BGP AS Path: 37100 → 43641

## Historical Activity

Analysis of 76 observations indicates persistent blacklist activity concentrated on July 28, 2026. Multiple high-severity listings were recorded within a 30-minute window, suggesting active monitoring of this IP's reputation.

## Neighborhood Assessment

The /24 subnet (213.111.147.0/24) shows an abuse density classification of "mostly_clean" with 1 threat sibling identified.

## Recommended Actions

Immediate:

1. Enhanced Verification: Consider additional verification for anonymous traffic from this IP

2. Log Review: Increase logging verbosity and review recent activity patterns

3. Access Control: Implement rate limiting or enhanced authentication for services accepting connections from this subnet

Firewall Implementation:

• iptables: `iptables -A INPUT -s 213.111.147.9 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 213.111.147.9 drop`
• nginx: `deny 213.111.147.9;`
• Cloudflare WAF: Block expression: `ip.src eq 213.111.147.9`
• AWS WAF: Address: `213.111.147.9/32`

Decision Guidance:

Given the confirmed Tor exit node status and blacklist presence, blocking is recommended for sensitive services. However, if the IP is legitimately required for certain traffic flows, implement enhanced monitoring and verification controls instead of outright blocking.

---

*Intel generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.