23.191.200.6📋 Copy

IP Intelligence Briefing: 23.191.200.6

Date: 2026-06-09

---

**Risk Profile**

• Overall Risk Score: 70/100 (High Risk)
• Threat Indicators:

- Tor exit node activity detected.

- Geolocation anomalies: 7,626 km distance vs. claimed 37.751°N, -97.822°W (New York, NY).

- RTT (Round-Trip Time) discrepancy: Observed 50ms vs. minimum possible 152.5ms for the distance.

• Network Role: Tor Exit Node (Provider: Unredacted Inc, ASN 401401).
• Services:

- Open ports: HTTP (80/TCP), HTTPS (443/TCP).

- TLS certificate: Self-signed, issued to `www.hk33xpsu3cz.com`, subject `www.yishwjinlbw.net`.

---

**Ownership & Geolocation**

• Organization: Unredacted Inc (AS 401401).
• Geolocation:

- Country: US (NY).

- Geo-plausibility: False (distance vs. claimed location).

- Accuracy radius: 2,500 km (low confidence).

• Subnet: 23.191.200.0/24.
• Neighbor Risk: Subnet abuse density: 0% (clean).

---

**Observation History**

• Recent Activity (30d):

- 27 observations, primarily Tor exit node signals.

- Persistent geolocation anomalies and DNSSEC validation issues.

- No significant changes in risk score or network behavior.

---

**Relationships**

• Linked Entities:

- Same network: 28 instances of "UNREDACTED-V4-01" (likely internal network labels).

- No direct links to known malicious organizations or domains.

---

**Recommended Actions**

1. Block/Restrict Access:

- Apply firewall rules to block traffic from 23.191.200.6.

- Example:

```bash

iptables -A INPUT -s 23.191.200.6 -j DROP

nft add rule inet filter input ip saddr 23.191.200.6 drop

```

2. Monitor Anomalies:

- Investigate geolocation inconsistencies and Tor exit node activity.

- Review TLS certificate validity and potential spoofing.

3. Network Segmentation:

- Isolate the subnet (23.191.200.0/24) if it contains other high-risk IPs.

---

**Key Flags**

• Tor Exit Node: Potential anonymity layer for malicious traffic.
• Geolocation Discrepancy: May indicate spoofing or misconfigured infrastructure.
• TLS Certificate: Self-signed with suspicious subject/issuer names.

Next Steps: Validate geolocation data, monitor for sustained malicious activity, and verify certificate legitimacy.

*Generated by IPDebrief – IP Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.