23.191.200.51📋 Copy

IP Intelligence Briefing: 23.191.200.51

Date: 2026-06-16

---

**1. Core Profile**

• Risk Score: 66 (Moderate Risk)
• Ownership: Unredacted Inc (ASN 401401)
• Geolocation: Registered to New York, US (geoPlausible: False)
• Threat Indicators:

- Tor exit node activity detected

- DNSBL listing (1/8)

- Open services: HTTP (80), HTTPS (443)

• Network Role: Identified as a Tor Exit Node with no clear infrastructure type.

---

**2. Observation History**

• Recent Activity (Last 30 Days):

- 46 observations logged, with minimal risk (score: 0.15) as the primary signal.

- Connection failures noted (e.g., "connection_failed" for HTTPS).

- RTT anomalies: Geolocation suggests ~7,626km distance, but minimum possible RTT is 152.5ms (observed: 45ms), indicating potential spoofing or synthetic data.

• Threat Persistence: No long-term malicious activity detected (threatObservationCount: 1).

---

**3. Relationships & Network Context**

• Linked Entities:

- Same network: UNREDACTED-V4-01 (repeated 52 times in relationships).

- Subnet: 23.191.200.0/24 with high abuse density (100 neighbors, 99 medium/high risk).

• Subnet Risk:

- 99/100 neighbors classified as medium/high risk.

- 67 neighbors flagged for threat activity.

- Abuse density score: 0.5447 (high risk).

---

**4. Actions & Recommendations**

• Block Tor Exit Nodes: Given the Tor exit association, consider blocking this IP in firewalls (e.g., iptables: `iptables -A INPUT -s 23.191.200.51 -j DROP`).
• Monitor Subnet: The subnet has a high abuse density; prioritize monitoring related IPs for lateral movement or cluster-based attacks.
• Verify Geolocation: Investigate the geoPlausible discrepancy (false) and RTT anomalies to rule out spoofing or misconfigured systems.
• Check TLS Certificates: The certificate issuer/subject (CN=www.bke6dql6thafqep.com) appears synthetic; validate if this is a honeypot or misconfigured service.

---

Conclusion:

This IP is a Tor exit node with open web services, linked to a high-risk subnet. While it shows minimal risk in some signals, the Tor association and subnet abuse density warrant closer scrutiny. SOC teams should monitor for unusual traffic patterns and consider blocking Tor exit nodes to mitigate potential threat vectors.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.