23.128.248.163📋 Copy

IP Intelligence Briefing: 23.128.248.163

*Generated via IPDebrief Analysis*

---

**Core Profile**

• Risk Score: 70 (High Risk)
• Ownership: StormyCloud Inc (AS400226)
• Geolocation: New York, NY, US (IPv4 subnet 23.128.248.0/24)
• Threat Indicators:

- Tor exit node activity detected

- Listed in 8+ threat intelligence feeds (high-severity listings)

- No SPF/DMArc records for associated domain (`stormycloud.org`)

• Network Role: Tor exit node, HTTP/HTTPS services (ports 80/443)
• TLS Certificate:

- Issuer: `CN=www.7vpzl5bvby4.com`

- Subject: `CN=www.jh4ctsqfomjkgi.net`

- Self-signed certificate detected

---

**Observation History**

• Threat Listings:

- 35 observations over 30 days (last 24h: 5 entries)

- 8+ threat feeds flagging IP (e.g., DNSBL, malware, phishing)

• DNS Activity:

- PTR hostname: `tor-exit-004.stormycloud.org`

- DNSSEC validation failed for zone `163.248.128.23.in-addr.arpa`

• Service Behavior:

- Open HTTP/HTTPS ports with no server banners

- TLS handshake shows anomalous certificate chain

---

**Relationships & Network Context**

• Linked Entities:

- Subnet: `23.128.248.0/24` (abuse density: 0%)

- Hostname: `tor-exit-004.stormycloud.org`

• Neighbor Analysis:

- 14 IPs in subnet; 2 medium-risk, 12 low-risk neighbors

- No high-risk siblings detected

---

**Actionable Intelligence**

1. Threat Level: High-risk Tor exit node with multiple threat listings.

2. Recommendations:

- Block traffic from this IP unless explicitly required.

- Investigate `stormycloud.org` for DNS misconfigurations or phishing campaigns.

- Monitor associated TLS certificates for further anomalies.

- Review subnet neighbors for potential lateral movement or network compromise.

Note: This IP exhibits characteristics of a malicious Tor exit node and is linked to threat intelligence feeds. Immediate containment is advised.

*Generated by IPDebrief | © 2026 Jason Alberino*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.