23.129.64.137📋 Copy

IP Intelligence Briefing: 23.129.64.137

Date: 2026-06-11

---

**1. Core Profile**

• Risk Score: 20 (Low Risk)
• Provider: Emerald Onion (AS396507)
• Geolocation: Seattle, WA, US (plausibility flagged due to RTT anomalies)
• Network Role: Tor Exit Node (classified as "Web Server" with open ports 80/443)
• Threat Indicators: No active malware, spam, or known attacker associations.

---

**2. Observation History**

• Recent Activity: Minimal risk detected over 36 observations.
• Anomalies:

- RTT Discrepancy: 80ms latency for 7,626km distance (implies spoofed geolocation or proxy).

- TLS Certificate: Self-signed with suspicious SANs (e.g., `www.usddt5mpvulajyo.com`).

- BGP Stability: Route stability score (0.15) suggests potential routing manipulation.

---

**3. Relationships & Network Context**

• Subnet: 23.129.64.0/24 (abuse density: 8.3%)
• Neighbors:

- 96 IPs in subnet, 7 high-risk, 81 medium-risk, 7 low-risk.

- Notable high-risk neighbors: 23.129.64.99, 23.129.64.130 (both scored 70).

• Network Affiliation: Linked to "EMERALD-ONION-TOR1" network (Tor Exit Node infrastructure).

---

**4. Technical & Threat Insights**

• Services:

- HTTP/HTTPS on ports 80/443.

- TLSv1.3 with `TLS_AES_256_GCM_SHA384` cipher.

• Certificate Issues:

- Self-signed certificate with mismatched issuer/subject (likely test or spoofed).

• Routing:

- BGP path: `6939 396507` (AS396507 is Emerald Onion).

- RPKI invalidation detected (potential route hijack risk).

---

**5. Actionable Threat Assessment**

• Risk Level: Low, but subnet abuse density (8.3%) warrants monitoring.
• Red Flags:

- Tor Exit Node association (could mask malicious activity).

- TLS certificate anomalies and RTT spoofing.

- High-risk neighbors in same subnet.

• Recommendations:

- Monitor for unexpected traffic patterns or connections to known malicious networks.

- Investigate TLS certificate validity and potential spoofing.

- Block high-risk neighbors (e.g., 23.129.64.99, 23.129.64.130) if they are not authorized.

- Verify geolocation accuracy for this IP and subnet.

---

Conclusion: While 23.129.64.137 itself shows no direct malicious activity, its association with Tor and the subnet’s abuse density suggest potential indirect risks. SOC teams should prioritize monitoring this subnet for lateral movement or command-and-control activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.