23.191.200.37📋 Copy

IP Intelligence Briefing: 23.191.200.37

*Generated via IPDebrief Threat Intelligence Platform*

---

**1. Core Risk Profile**

• Risk Score: 70 (High Risk)
• Threat Indicators:

- Marked as a Tor exit node (potential anonymity layer for malicious activity).

- Observed TLS certificate anomalies (issuer/subject mismatch, unvalidated chain).

- DNSSEC validation failure (potential spoofing risk).

• Ownership:

- ASN: 401401 (Unredacted Inc)

- Geolocation: US-NY (New York), but geoPlausible = false (RTT mismatch for distance).

• Network Role:

- Classified as a Tor exit node with open HTTP/HTTPS ports.

- No CDN/VPN/mobile carrier indicators.

---

**2. Temporal Observations (Last 30 Days)**

• First Seen: 2026-06-09 (TLS certificate scan, connection failures).
• Key Trends:

- TLS certificate (self-signed, invalid SANs) detected in 1 observation.

- DNSSEC validation failure (1 observation).

- Operator risk score: 0.13 (Minimal), but abuse density in subnet is 0.

---

**3. Network Relationships**

• Linked Entities:

- Same Network: Repeatedly linked to "UNREDACTED-V4-01" (likely internal subnet).

- Tor ecosystem: Strong ties to Tor exit node infrastructure.

• Subnet Analysis:

- /24 subnet (23.191.200.0/24):

- 123 total IPs, 0 active/compromised siblings.

- Abuse density: 0 (clean classification).

---

**4. Neighborhood Risk**

• Subnet Risk Distribution:

- High-risk IPs: 0 (score ≥ 50).

- Medium-risk IPs: 43 (25–49).

- Low-risk IPs: 57 (≤25).

• Notable Neighbors:

- 23.191.200.6: Risk score 70 (high-risk outlier).

- 23.191.200.2–5: Moderate risk (25–20).

---

**5. Actionable Threat Indicators**

• Tor Exit Node:

- Monitor for data exfiltration or command-and-control (C2) traffic.

- Consider blocking Tor exit nodes if this IP is part of a known malicious campaign.

• TLS Certificate Anomalies:

- Investigate potential MITM attacks or spoofed services.

• Geolocation Discrepancy:

- Validate IP source authenticity; potential spoofing or misconfigured geolocation.

---

**6. Recommended Mitigations**

• Firewall Rules:

- Block traffic from 23.191.200.0/24 (subnet-level mitigation).

- Restrict HTTP/HTTPS ports (80/443) to trusted IPs.

• Monitoring:

- Track TLS certificate changes and Tor exit node activity.

- Validate geolocation data for this subnet.

---

Summary: This IP is a Tor exit node with high-risk indicators, including TLS certificate anomalies and geolocation inconsistencies. While the subnet appears clean, the Tor association warrants closer monitoring for potential malicious activity.

*Generated by IPDebrief | © 2026 Jason Alberino*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.