23.129.64.215📋 Copy

IP Intelligence Briefing: 23.129.64.215

Date: 2026-06-11

---

**1. Core Profile**

• Risk Score: 70 (High Risk)
• Provider: Emerald Onion (Tor Exit Node)
• Geolocation: Seattle, WA, US (geoPlausible: False)
• Threat Indicators:

- Tor exit node activity detected

- Listed in 4 DNSBLs (DNS-Based Blacklist)

- TLS certificate issuer: `www.kodoseip6pau22a.com` (suspicious domain)

• Network Role: Tor Exit Node (BGP prefix: 23.129.64.0/24)
• Services:

- Open ports: 80 (HTTP), 443 (HTTPS)

- TLS protocol: TLS 1.3

- Certificate: Self-signed, with SANs pointing to dubious domains

---

**2. Observation History**

• Recent Signals (Last 30 Days):

- Consistent Tor exit node activity

- DNSSEC validation: Valid

- BGP route stability: Stable (no recent changes)

- TLS certificate renewals observed

• Anomalies:

- Round-Trip Time (RTT) of 79ms for 7,626km distance (inconsistent with physical distance)

- Low geoPlausibility score (7625.7km distance vs. 2500km accuracy radius)

---

**3. Relationships**

• Linked Entities:

- Same network: `EMERALD-ONION-TOR1` (Tor network)

- Related IPs: 39+ entities (primarily Tor exit nodes)

• Key Associations:

- Shares BGP prefix with 96 sibling IPs in 23.129.64.0/24 subnet

- Multiple DNSBL listings (e.g., Spamhaus, Project Honey Pot)

---

**4. Neighborhood Analysis**

• Subnet: 23.129.64.0/24
• Abuse Density: 28.87% (moderate risk)
• Neighbor Risks:

- 8 high-risk IPs (70+ score)

- 80 medium-risk IPs (50–69 score)

- 8 low-risk IPs (<50 score)

• Notable Neighbors:

- 23.129.64.99, 23.129.64.130, 23.129.64.131 (similar risk profiles)

---

**5. Threat Assessment**

• Likelihood of Malicious Activity:

- High risk due to Tor exit node association and DNSBL listings

- Potential for phishing, MITM, or covert data exfiltration via Tor

• Recommendations:

- Block traffic from this IP in firewall rules (e.g., iptables, AWS WAF)

- Monitor subnet for additional high-risk IPs

- Investigate TLS certificate validity and domain ownership

---

Conclusion:

This IP is a Tor exit node with high-risk indicators, likely used for anonymized malicious activity. The subnet exhibits moderate abuse density, warranting closer monitoring. SOC teams should prioritize blocking this IP and validating associated certificates to mitigate potential threats.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.