213.202.233.140📋 Copy

# IP Intelligence Briefing: 213.202.233.140

## Executive Summary

IP address 213.202.233.140 presents a Moderate Risk threat profile (risk score: 59) with confirmed Tor exit node activity and multiple blacklist listings. The IP belongs to WIIT AG NOC and is geolocated to Ühlingen-Birkendorf, Germany. SOC teams should monitor this IP for potential abuse of Tor infrastructure and related malicious activities.

---

## Ownership & Infrastructure

• ASN: 24961 (WIIT AG NOC)
• Organization: WIIT AG NOC
• Network: 213.202.192.0/18 (RIR: RIPE)
• Geolocation: Ühlingen-Birkendorf, Baden-Wurttemberg, Germany (DE)
• DNS PTR: srv20935.dus7.dedicated.server-hosting.expert
• Forward Resolution: Forward confirmed (1 hostname)

---

## Threat Indicators

• Primary Concern: Tor exit node activity detected
• Blacklist Status: Listed on 1 of 8 monitored DNSBLs
• Threat Indicators: Tor exit indicators observed
• Abuse Confidence: Evidence indicates Tor infrastructure usage
• Known Campaigns: None identified
• DNSBL Listings: 1 current listing

---

## Network Services

• Open Ports:

- TCP/80 (HTTP)

- TCP/443 (HTTPS)

- TCP/22 (SSH - OpenSSH_10.0p2 Debian)

• TLS Certificate: CN=www.cmsrl2pisrgrzu.com (subject: CN=www.vozkgeyjky.net)
• SSL Status: Non-self-signed certificate

---

## Risk History

• Observations: 72 historical signals recorded
• Recent Activity: Multiple high-severity blacklist listings detected on 2026-07-23 (08:57-10:52 UTC)
• Listings: 1 of 8 total blacklist checks triggered, with maximum severity rated "high"
• Threat Persistence: Single threat observation event (not persistently malicious)
• Operator Score: 0.4783 (Basic classification)

---

## Network Relationships

• Total Relationships: 293 associations
• DNS Associations: Multiple entries mapping to srv20935.dus7.dedicated.server-hosting.expert
• Infrastructure Type: Dedicated server hosting environment

---

## Neighborhood Analysis

• Subnet: 213.202.233.140/24
• Abuse Density: 1 (moderate)
• Classification: Mostly clean
• Threat Siblings: 1 identified
• Risk Distribution: Low threat density in immediate subnet

---

## Recommended Actions

1. Monitor Tor Exit Node Activity: Track outbound connections from this IP for potential abuse

2. Blacklist Monitoring: Maintain awareness of DNSBL listing status (1 of 8 lists)

3. Traffic Analysis: Inspect HTTPS traffic for suspicious patterns given Tor exit node classification

4. SSH Access: Review SSH connection logs for unauthorized access attempts

5. Certificate Analysis: Monitor TLS certificate usage for potential spoofing or abuse

---

## Conclusion

This IP represents a legitimate hosting infrastructure operating as a Tor exit node. While not inherently malicious, the Tor exit node designation creates elevated risk for abuse scenarios. SOC analysts should focus on monitoring outbound traffic patterns and blacklist status rather than blocking the IP outright. The single high-severity blacklist listing and Tor exit node status warrant continued observation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.