23.129.64.213📋 Copy

IP Intelligence Briefing: 23.129.64.213

*Generated via IPDebrief analysis*

---

**1. Core Risk Profile**

• Risk Score: 70 (High Risk)
• Threat Indicators:

- Identified as a Tor exit node (indicates potential anonymity services or malicious traffic exit points).

- No known spam, attacker, or campaign associations.

• Network Role: Tor Exit Node (provider: Emerald Onion).
• Geolocation:

- Registered to Seattle, WA, US (ARIN).

- Geo Plausibility: False (RTT anomaly suggests discrepancy between location and network behavior).

---

**2. Ownership & Infrastructure**

• ASN: 396507 (Emerald Onion)
• Network Classification:

- Subnet: 23.129.64.0/24

- Abuse Density: 8.3% (96 total neighbors; 8 high-risk, 88 medium-risk).

• Services:

- Open ports: HTTP (80), HTTPS (443).

- TLS Certificate:

- Issuer: `www.c2bofo5aw6euwsuomzy4.com`

- Subject: `www.gulywemm5.net`

- Self-signed: False (potential spoofing risk).

---

**3. Threat Observations**

• History:

- 29 observations over time, with minimal risk operator score (0.13).

- Geo Validation Violation: RTT of 83ms inconsistent with 7,626km distance (minimum plausible RTT: 152.5ms).

• Neighbor Analysis:

- Subnet contains 96 IPs; 8 high-risk neighbors (e.g., 23.129.64.99, 23.129.64.130).

- Abuse Density: 8.3% (mostly clean, but elevated risk).

---

**4. Relationships & Context**

• Linked Entities:

- Same Network: EMERALD-ONION-TOR1 (repeated 29x).

• Threat Correlation:

- No direct campaigns or malicious activity linked to this IP.

- Tor Exit Node: Commonly used for covert communications or malicious traffic exfiltration.

---

**5. Recommended Actions**

• Monitor Traffic: Track HTTP/HTTPS activity for anomalies (e.g., unexpected TLS certificates, data exfiltration).
• Subnet Review: Investigate high-risk neighbors in 23.129.64.0/24 for potential network-wide threats.
• Geolocation Verification: Confirm IP legitimacy via alternative geolocation sources.
• Firewall Rules: Consider blocking Tor exit node traffic if not required (e.g., using iptables or Cloudflare WAF rules).

---

*End of Briefing*

*Generated by IPDebrief – Threat Intelligence for SOC Analysts*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.