23.191.200.103📋 Copy

IP Intelligence Briefing: 23.191.200.103

*Generated via IPDebrief tools: Profile, History, Relationships, Neighbors*

---

**1. Core Risk Profile**

• Risk Score: 70 (High Risk)
• Threat Indicators:

- Tor exit node activity detected.

- TLS certificate issued to suspicious domain (`www.sihqikxwjftksui2q7k.com`).

• Ownership:

- ASN 401401 (Unredacted Inc).

- No abuse contact publicly listed.

• Geolocation:

- Country: US (New York), but coordinates, timezone, and RTT validation are inconsistent (plausible distance 7,626km vs. minimal RTT of 44ms).

---

**2. Network Activity**

• Services:

- Open ports: 80 (HTTP), 443 (HTTPS).

- TLS certificate: Self-signed, issued to domains linked to phishing/malware campaigns.

• Network Role:

- Identified as a Tor exit node, likely used for anonymized malicious traffic.

• BGP/Control Plane:

- Subnet: 23.191.200.0/24 (abuse density: 0).

- Route stability: Unstable (operator score: 0.13).

---

**3. Observation History**

• Recent Activity (June 9–10, 2026):

- Tor exit node signals detected.

- Geolocation inconsistencies flagged (RTT mismatch for distance).

- DNSSEC validation: Mixed results.

• Trend: No significant changes in risk score or threat indicators.

---

**4. Relationships & Neighbors**

• Network Peers:

- Linked to subnet 23.191.200.0/24.

- 100+ neighbors: 65 medium-risk, 35 low-risk (abuse density: 0).

• Relationships:

- Repeated "Same Network" links to "UNREDACTED-V4-01" (likely a data inconsistency or redaction).

---

**5. Actionable Intelligence**

• Threat Level: High (Tor exit node + suspicious TLS certs).
• Recommended Actions:

- Block IP via firewall (iptables/nftables) and WAF rules.

- Monitor related domains (`www.sihqikxwjftksui2q7k.com`) for phishing/malware.

- Investigate geolocation anomalies (RTT mismatch).

- Scan subnet 23.191.200.0/24 for additional compromised hosts.

---

Conclusion: This IP is associated with Tor exit node activity and potentially malicious TLS infrastructure. Prioritize blocking and further analysis of its network peers and certificate domains.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.