23.129.64.168📋 Copy

IP Intelligence Briefing: 23.129.64.168

Date: 2026-06-17

---

**1. Risk Profile**

• Overall Risk Score: 80 (High Risk)
• Threat Indicators:

- Confirmed Tor exit node (emerging from the Tor network).

- High abuse density in its /24 subnet (23.129.64.0/24).

- 54 of 96 neighboring IPs in the subnet are flagged as malicious.

• Ownership:

- Assigned to Emerald Onion (ASN 396507), a Tor-related entity.

- ARIN-registed with a 3,274-day allocation history.

---

**2. Geolocation & Validation**

• Claimed Location: Seattle, WA, US.
• Geo Validation:

- Inconsistent: RTT (Round-Trip Time) of 83ms contradicts the 7,626km distance, suggesting potential spoofing or routing anomalies.

- Geolocation Plausibility: False (likely inaccurate or synthetic data).

---

**3. Network & Service Activity**

• Open Ports:

- TCP 80 (HTTP), TCP 443 (HTTPS).

- TLS certificate observed with issuer `CN=www.hnf2fi4sjrsnfixam6g.com` and subject `CN=www.nq6wmbwnpjcpxn75.net`.

• Network Role:

- Classified as a Tor exit node (not a standard Tor relay).

- BGP route stability: Stable (no recent changes).

---

**4. Threat Observations**

• Historical Signals:

- 57 observations over 30 days, with 85% confidence in ownership and routing data.

- No persistent malicious activity detected (threat persistence days: 0).

• Malicious Associations:

- 5 DNSBL listings (high-risk IP in 8/10 DNSBLs).

- No known campaigns or malware families linked.

---

**5. Subnet & Neighborhood Context**

• Subnet: 23.129.64.0/24 (97 total IPs).
• Neighbor Risk:

- 23 IPs in the subnet have high risk (≥70).

- 73 IPs have medium risk (50–69).

- 0 IPs have low risk (<50).

• Abuse Density: 55.7% of subnet IPs are flagged as abusive.

---

**6. Recommendations**

• Block Traffic: Consider blocking this IP in firewalls (e.g., iptables, AWS WAF) due to its Tor exit node status and high-risk profile.
• Monitor Subnet: Investigate neighboring IPs (e.g., 23.129.64.99, 23.129.64.130) for potential lateral movement or network compromise.
• Verify Geolocation: Validate the IP’s claimed location using additional geolocation tools, as RTT anomalies suggest possible spoofing.
• Check TLS Certificates: Monitor traffic using the observed TLS certificates for potential data exfiltration or C2 (command and control) activity.

---

Source: IPDebrief Threat Intelligence Platform

Note: This IP is associated with Tor exit nodes, which are commonly used for anonymizing malicious activities. Further investigation is recommended to confirm the intent of traffic originating from this IP.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.