23.129.64.164📋 Copy

IP Intelligence Briefing: 23.129.64.164

Date: June 12, 2026

---

**1. Risk Profile**

• Risk Score: 70 (High Risk)
• Network Role: Tor Exit Node (Emerald Onion)
• Geolocation: Seattle, WA, US (geoPlausible: False)
• Subnet Abuse Density: 43.3% (23.129.64.0/24)

---

**2. Ownership & Infrastructure**

• ASN: 396507 (Emerald Onion)
• Network Classification: Mixed (abuse density: 0.433)
• Services:

- Open ports: HTTP (80), HTTPS (443)

- TLS Certificate:

- Issuer: `CN=www.fddsfs3fhs3y.com`

- Subject: `CN=www.4fq5kza7a5q.net`

- Self-signed: False

• Control Plane:

- BGP AS Path: `6939 396507`

- DNSSEC Valid: True

- Route Stability: Stable (no recent changes)

---

**3. Threat Indicators**

• DNSBL Listings: 4/8 (moderate risk)
• Historical Observations (Last 30 Days):

- 45 total signals (40+ threat-related)

- High-severity listings: 12 (e.g., malicious domains, spoofed certs)

- BGP anomalies: 3 (AS path inconsistencies)

• Relationships:

- Linked to 66+ IPs in the same subnet (42 flagged as threats)

- Associated with Tor network "EMERALD-ONION-TOR1"

---

**4. Actionable Insights**

• Threat Vector: Likely used for anonymity-based attacks (Tor exit node). Monitor for C2 traffic or data exfiltration.
• Subnet Risk: High abuse density suggests potential for botnet activity or malware distribution.
• Certificate Anomalies: Suspicious TLS certificate issuer/subject pairs; verify legitimacy.
• Recommendations:

- Block IP in firewall rules (iptables/nftables).

- Monitor DNS queries for spoofed domains.

- Investigate TLS handshake anomalies.

---

Next Steps:

• Correlate with known Tor exit node campaigns.
• Validate certificate authority chains.
• Block subnet (23.129.64.0/24) if further abuse is detected.

Source: IPDebrief Threat Intelligence Platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.