23.191.200.105📋 Copy

IP Intelligence Briefing: 23.191.200.105

Date: 2026-06-10

---

**1. Core Profile**

• Risk Score: 70 (High Risk)
• Threat Indicators:

- Tor exit node activity detected.

- Listed in 8 threat feeds (1 high-severity listing).

• Ownership:

- ASN: 401401 (Unredacted Inc, ARIN).

- Subnet: 23.191.200.0/24.

• Geolocation:

- US (New York), but geolocation accuracy is questionable (7625km distance vs. 152.5ms RTT).

• Network Role:

- Identified as a Tor exit node, hosting HTTP/HTTPS services.

---

**2. Observation History**

• Recent Activity (Last 31 Days):

- 31 observations recorded, with 26 high-severity threat listings.

- Key Trends:

- Persistent Tor exit node activity.

- Multiple listings in DNSBLs (e.g., Spamhaus, Project Honey Pot).

- Stability score indicates unstable routing (route changes detected).

• Risk Evolution:

- No significant change in risk score over time.

---

**3. Relationships & Neighbors**

• Network Relationships:

- Linked to 29 IPs in the same subnet (23.191.200.0/24).

- All neighbors share the same ASN (401401) and network label "UNREDACTED-V4-01."

• Subnet Analysis:

- 100 neighbors in subnet; 82% low/medium risk, 18% high risk.

- One neighbor (23.191.200.6) has a risk score of 70 (same as the target IP).

• Potential Clustering:

- Suggests coordinated activity or shared infrastructure within the subnet.

---

**4. Threat Context**

• Tor Exit Node:

- Exit nodes can be used for malicious activities (e.g., traffic exfiltration, censorship circumvention).

- This IP has been flagged as a Tor exit node in multiple threat feeds.

• DNS & Services:

- Hosts HTTP/HTTPS services but lacks SSL certificate validation.

- No DNSSEC or email authentication (SPF/DKIM) detected.

• Abuse Density:

- Subnet has 0 abuse density, but the IP’s Tor association raises red flags.

---

**5. Recommendations**

• Monitor Traffic:

- Investigate traffic originating from or destined to this IP, especially outbound connections.

• Block Tor Exit Nodes:

- Consider blocking Tor exit nodes in your network to prevent misuse.

• Subnet Review:

- Reassess trust in the 23.191.200.0/24 subnet due to high-risk neighbors.

• DNSBL Checks:

- Verify if the IP is listed in DNSBLs and take action based on threat feed data.

---

Summary:

23.191.200.105 is a high-risk Tor exit node with historical ties to multiple threat feeds. While its subnet has low abuse density, its association with Tor and persistent threat listings indicates potential for malicious activity. Immediate monitoring and mitigation are recommended.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.