23.129.64.136📋 Copy

IP Intelligence Briefing: 23.129.64.136

Date: 2026-06-11

---

**1. Core Profile**

• Risk Score: 70 (High Risk)
• Ownership:

- ASN: 396507

- Organization: Emerald Onion (Tor Exit Node)

- Geolocation: Seattle, WA, US (geoPlausible: False)

• Threat Indicators:

- Tor exit node activity detected.

- Listed in 4/8 DNSBLs (high-severity threats).

- BGP route stability flagged (irrConsistency: None).

• Network Role: Tor exit node (classified as "Web Server" with HTTP/HTTPS services).

---

**2. Observation History**

• Total Signals: 35 observations (last 30 days).
• Key Threats:

- 4 DNSBL listings (e.g., Spamhaus, Project Honey Pot).

- High-severity threat feeds (e.g., malicious DNS resolution).

- TLS certificate anomalies (self-signed, expired, or invalid).

• Trend: Persistent risk with no decline in threat signals.

---

**3. Relationships & Network Context**

• Network Affiliation:

- Part of EMERALD-ONION-TOR1 network (same subnet).

- Linked to 44+ IPs in the same /24 subnet.

• Subnet Abuse:

- Abuse Density: 8.3% (8 high-risk neighbors out of 96).

- Neighbors include IPs with similar risk profiles (70–70 score).

• Geographic Anomalies:

- RTT (77ms) inconsistent with 7,626km distance (minimum expected: 152.5ms).

---

**4. Technical Analysis**

• Services:

- Open ports: 80 (HTTP), 443 (HTTPS).

- TLS certificate: Issued to `www.mt6l5ljgphuqqrwsum.com` (self-signed, expired).

• Control Plane:

- BGP AS Path: `6939 396507` (Emerald Onion).

- DNSSEC valid but route stability flagged.

• Fingerprint: No server banners or HTTP title detected.

---

**5. Recommendations**

1. Block Traffic: Implement firewall rules to block this IP (via iptables/nftables, Cloudflare WAF, etc.).

2. Monitor Subnet: Investigate neighboring IPs (e.g., 23.129.64.99, 23.129.64.130) for similar risks.

3. Threat Feeds: Add to SOC monitoring lists (e.g., DNSBLs, Tor exit node databases).

4. Geolocation Discrepancy: Verify if spoofed location or proxy is used (low RTT vs. distance).

5. TLS Inspection: Analyze HTTPS traffic for malicious payloads (TLS_AES_256_GCM_SHA384 cipher suite).

---

Summary: This IP is a high-risk Tor exit node associated with known malicious activity. Its subnet contains other risky IPs, and its geographic anomalies suggest potential obfuscation. Immediate mitigation is advised.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.