23.129.64.214📋 Copy

IP Intelligence Briefing: 23.129.64.214

Date: 2026-06-09

---

**1. Core Profile**

• Risk Score: 70 (High Risk)
• Network: Emerald Onion Tor Exit Node (ASN 396507)
• Geolocation: United States (Seattle, WA), flagged as Tor exit node.
• Threat Indicators:

- Identified as a Tor exit node (high-risk category).

- No known malware or spam sources.

- DNSSEC validation: Enabled.

- BGP Stability: Unstable route (route changes detected).

---

**2. Observation History**

• Recent Activity (2026-06-09):

- Confirmed as a Tor exit node with high-risk score (100).

- Linked to proxycheck.io as a "Minimal" risk proxy (score 0.15).

- No persistent malicious behavior detected (threat persistence days: 0).

---

**3. Network Relationships**

• Associated Entities:

- Directly linked to EMERALD-ONION-TOR1 network.

- No connections to known malicious organizations or domains.

• Services:

- No open ports or TLS services detected.

- No HTTP server banners or certificate matches.

---

**4. Subnet Neighborhood**

• Subnet: 23.129.64.0/24
• Abuse Density: 8.3% (low overall, but 8 IPs flagged as high-risk).
• Notable Neighbors:

- 23.129.64.99, 23.129.64.130–133 (all risk scores: 55–70).

- Subnet classified as "clean" but contains Tor-related infrastructure.

---

**5. Threat Context**

• Tor Exit Node: This IP is part of the Emerald Onion Tor network, which is a known entry point for anonymized traffic. While Tor itself is not inherently malicious, exit nodes can be exploited for data exfiltration or launching attacks.
• Neighbor Risk: The subnet contains a mix of low- and high-risk IPs, but no direct correlation to known campaigns or malicious activity.
• Geolocation Discrepancy: The IP’s reported location (Seattle, WA) is inconsistent with its RTT (round-trip time) for a 7,626 km distance, suggesting potential spoofing or routing anomalies.

---

**6. Recommended Actions**

1. Monitor Traffic: Block or monitor traffic originating from this IP/subnet, especially if it connects to internal assets.

2. Investigate Tor Exit Nodes: Check for suspicious outbound traffic from this subnet, as Tor exit nodes are often used in C2 (command-and-control) or data exfiltration scenarios.

3. Verify Subnet Health: Review the 23.129.64.0/24 subnet for other high-risk IPs, as Tor networks may host multiple malicious nodes.

4. Check for Anomalies: Investigate the geolocation discrepancy and routing stability issues to rule out spoofing or misconfigured infrastructure.

---

End of Briefing

*Generated by IPDebrief intelligence tools.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.