23.129.64.143📋 Copy

IP Intelligence Briefing: 23.129.64.143

Date: 2026-06-12

---

**Key Risk Indicators**

• Risk Score: 70 (High Risk)
• Threat Classification: Tor exit node (confirmed via indicators)
• Network Role: Tor Exit Node (part of Emerald Onion network)
• Geolocation: Seattle, WA, US (geoPlausible: False)
• Abuse Density: 10.4% (subnet abuse density: 0.104)

---

**Ownership & Infrastructure**

• AS: AS396507 (Emerald Onion)
• Network: 23.129.64.0/24 (subnet abuse density: 43.3%)
• Services: Open ports 80 (HTTP) and 443 (HTTPS). TLS certificate with self-signed issuer "www.gburjfag.com".
• BGP: Route stability confirmed; AS path: 6939 396507.

---

**Threat Observations**

• Tor Exit Activity: Confirmed as Tor exit node with 1 observed threat signal.
• DNS & Email: No SPF/DMArc records detected; no email auth configuration.
• TLS: TLS 1.3 used with cipher suite TLS_AES_256_GCM_SHA384.
• Historical Signals:

- 41 total observations (last 30 days).

- 17 high-risk signals (e.g., DNSBL listings, route instability).

- 42 neighboring IPs in subnet classified as high/medium risk.

---

**Neighbor Network Analysis**

• Subnet: 23.129.64.0/24 (97 total IPs).
• High-Risk Neighbors: 10 IPs (10.3% of subnet).
• Abuse Density: 43.3% of subnet IPs flagged for abuse.
• Notable Neighbors:

- 23.129.64.99, 23.129.64.130, 23.129.64.131 (all high/medium risk).

---

**Actionable Threat Narrative**

This IP is a Tor exit node associated with the "Emerald Onion" network, which is linked to anonymized traffic. The high-risk score and Tor exit indicators suggest potential misuse for隐蔽 malicious activities.

• Monitor for Anomalous Traffic: Track connections to this IP for unusual patterns (e.g., mass scans, data exfiltration).
• Subnet-Wide Risk: The subnet has a 43.3% abuse density, with 10 high-risk neighbors. Consider blocking the entire subnet or implementing granular access controls.
• TLS & Services: The TLS configuration is outdated (TLS 1.3 with weak cipher suites). Investigate if this IP is hosting malicious services.
• Geolocation Discrepancy: GeoPlausible flag is false, indicating potential spoofing or misconfigured routing.

Recommendation: Block this IP unless it’s part of a legitimate Tor infrastructure. Prioritize monitoring related IPs in the 23.129.64.0/24 subnet for coordinated threats.

---

Source: IPDebrief Threat Intelligence Platform.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.