23.129.64.201📋 Copy

IP Intelligence Briefing: 23.129.64.201

*Generated via IPDebrief tools: profile, history, relationships, neighbors, and actions.*

---

**1. Risk Profile**

• Risk Score: 70/100 (High Risk)
• Provider: Tor Exit Nodes (ASN 396507, Emerald Onion)
• Geolocation:

- Claimed: Seattle, WA, US (2500km accuracy radius)

- Validation: GeoPlausible = False (RTT mismatch: 82ms vs. expected 152.5ms for distance)

• Network Role: Tor Exit Node (classified as "Web Server" with HTTP/HTTPS services open).

---

**2. Threat Indicators**

• No Direct Threats: No indicators of spam, malware, or known attacker activity.
• TLS Certificate:

- Issuer: `CN=www.iovmxw57nyx7nqgy.com`

- Subject: `CN=www.proqt4gb3.net` (SANs not listed).

• BGP Analysis:

- Route stability: Stable (no recent changes).

- ASN 396507 (Emerald Onion) is linked to Tor infrastructure.

---

**3. Observation History**

• Recent Activity:

- 30-day history shows minimal risk (operator score 0.13) with no persistent malicious behavior.

- Geo validation violations suggest potential spoofing or misconfigured routing.

• Trend: No significant increases in risk or threat signals.

---

**4. Network Relationships**

• Subnet: 23.129.64.0/24 (96 sibling IPs).
• Abuse Density: 8.3% (low subnet-wide abuse).
• Neighbors: 8 IPs in the subnet share the same high-risk score (70), including:

- 23.129.64.99, 23.129.64.130–133 (all riskScore 70).

• Shared Network: Linked to EMERALD-ONION-TOR1 (Tor exit node network).

---

**5. Recommended Actions**

• Monitoring: Increase logging verbosity for traffic from this IP.
• Blocking:

- Firewall Rules:

```bash

iptables -A INPUT -s 23.129.64.201 -j DROP

nft add rule inet filter input ip saddr 23.129.64.201 drop

```

- Cloud/WAF:

- Cloudflare: `ip.src eq 23.129.64.201` (block).

- AWS WAF: Add `23.129.64.201/32` to a rule.

---

**6. Summary**

This IP is a Tor exit node associated with Emerald Onion, showing no direct malicious activity but elevated risk due to its Tor association and geo validation discrepancies. While the subnet has low abuse density, the IP’s high risk score warrants monitoring and blocking to mitigate potential risks tied to its Tor infrastructure role.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.