23.95.192.178📋 Copy

# IP INTELLIGENCE BRIEFING: 23.95.192.178

Classification: HIGH RISK

Date: 2026-07-28

Analyst: IPDebrief Intelligence Team

---

## EXECUTIVE SUMMARY

IP address 23.95.192.178 is a confirmed Tor exit node with an elevated risk score of 70/100. The address belongs to RackNerd LLC (ASN 36352) and exhibits characteristics consistent with anonymizing traffic proxy infrastructure. Defensive action is recommended pending correlation with additional threat intelligence.

---

## OWNERSHIP AND NETWORK ATTRIBUTES

The IP is registered under CC-23-95-192-160-27 network block. Geolocation data shows Buffalo coordinates (42.89°N, -78.88°W) with geo-consensus enabled, though RTT validation flags a 6,108km distance discrepancy suggesting potential geolocation spoofing.

---

## THREAT INDICATORS

Primary Indicators

• Tor Exit Node: Confirmed (isTorExit: true)
• Blacklist Status: Listed on 1 threat feed
• Risk Score: 70/100 (High Risk)
• Abuse Confidence: Not available

Network Classification

• Provider Classification: Tor Exit Nodes
• Connection Type: Web Server
• Campaign Association: None identified
• Known Attacker: No
• Spam Source: No

---

## NETWORK BEHAVIOR ANALYSIS

DNS Analysis

• PTR Record: mta181.ef92b778bafe771e.net
• Forward Resolution: Confirmed (1 hostname)
• Email Authentication: DMARC present, SPF not configured
• DNSSEC: Valid

Service Exposure

TLS Certificate Analysis

• Issuer: CN=www.tdcewsou3rsvvclem4.com
• Subject: CN=www.yi3pvclqlidt.net
• Certificate Status: Self-signed false, but domains appear randomly generated

---

## NEIGHBORHOOD CONTEXT

Subnet: 23.95.192.178/24

• Abuse Density: 0.5 (moderate)
• Total Siblings: 2
• Active Siblings: 2
• Threat Siblings: 1
• Neighbor Risk: 23.95.192.150 (Risk Score: 20, Authority Score: 50)

The /24 subnet shows mixed reputation with one threat-identified sibling.

---

## OBSERVATION HISTORY

Total Observations: 31 signals across monitoring period

Recent Key Findings (2026-07-28):

• 23:40:52 UTC – Control plane operator score: 0.25 (Minimal)
• 23:40:52 UTC – Full signal analysis (confidence: 0.42)
• 20:12:23 UTC – Subnet abuse density: 0.5 (classification: mostly_clean)
• 19:41:21 UTC – Ownership persistence: 0 days, no persistent malicious activity
• 19:39:14 UTC – Tor Exit Node detected (confidence: 0.80)

The IP shows recent Tor exit node classification with no evidence of persistent malicious campaign activity.

---

## RELATED ENTITIES

DNS Associations: Multiple hostname records pointing to mta181.ef92b778bafe771e.net

• 22 DNS association records identified
• No additional related IPs in relationship graph

---

## DEFENSIVE RECOMMENDATIONS

Immediate Actions

1. Access Control: Consider enhanced verification for anonymous traffic from this IP

2. Monitoring: Increase logging verbosity and review recent activity from this source

3. Threat Severity: High (risk score 70/100)

Firewall Rule Implementation

---

## ANALYST NOTES

This IP exhibits classic Tor exit node behavior. The combination of:

1. Explicit Tor exit node classification

2. Suspicious DNS hostname pattern

3. Elevated risk score (70/100)

4. Web server with SSH exposure

...warrants defensive blocking in most organizational contexts. However, correlation with internal threat intelligence and traffic analysis should precede permanent blocking to avoid potential false positives.

Recommendation: Block immediately pending further investigation.

---

*Report generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.