31.14.40.92
# IP Intelligence Briefing: 31.14.40.92/32
## Executive Summary
IP 31.14.40.92 is identified as a Tor exit node with a moderate risk score of 59/100. The address belongs to Romanian-based infrastructure (ASN 19624, Andi Cocei) and is currently listed on one blacklist with high severity. No active services are detected on the host.
## Risk Assessment
| Metric | Value |
|---|---|
| Risk Score | 59 (Moderate) |
| Abuse Density | 0 (Subnet-level) |
| Blacklist Count | 1 (High severity) |
| Total Lists | 8 |
| Classification | Tor Exit Node |
## Technical Profile
- Organization: Andi Cocei (Netname: RO-DATAROOM-20110418)
- ASN: 19624 (RIPE)
- Geolocation: Romania (45.94°N, 24.97°E)
- CIDR Block: 31.14.40.0/23
- DNS Resolution: mail.zkmail.org, localhost
- PTR Record: localhost
## Threat Indicators
- Tor Exit Node: Confirmed via network classification
- Blacklist Presence: Listed on 8 threat feeds, 1 confirmed listing with high severity rating
- Recent Activity: 33 observation signals recorded over the reporting period
- Network Role: Provider infrastructure with no active services detected
## Historical Observations
Recent signal history indicates:
- Traceroute attempts show ICMP blocking (30 hops, 29 timed out)
- DNS records properly configured with SPF and DMARC policies
- Blacklist monitoring detected elevated severity classifications
## Network Context
- Subnet Analysis: 31.14.40.0/24 classified as "mostly_clean" with abuse density of 0
- Related Networks: 91 relationship entries primarily mapped to RO-DATAROOM-20110418
- Route Stability: Not stable (1 route change in 30 days)
## Recommended Actions
| System | Recommended Action |
|---|---|
| iptables | `iptables -A INPUT -s 31.14.40.92 -j DROP` |
| nftables | `nft add rule inet filter input ip saddr 31.14.40.92 drop` |
| nginx | `deny 31.14.40.92;` |
| Cloudflare WAF | Block IP 31.14.40.92/32 |
| AWS WAF | Add 31.14.40.92/32 to deny list |
## Operational Guidance
The IP should be blocked at perimeter controls due to confirmed Tor exit node classification and blacklist presence. No immediate threat to infrastructure integrity detected, but enhanced logging recommended for any observed traffic patterns. The subnet remains largely clean—no adjacent IP risk correlation observed.
*Analysis based on IPDebrief intelligence platform data. Verify with additional context before implementing blocking rules.*
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Andi Cocei |
| ASN | AS19624 |
| Network Name | RO-DATAROOM-20110418 |
| CIDR Block | 31.14.40.0/23 |
| RIR | RIPE |
| Country | RO |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | localhost |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | mail.zkmail.org |
🔐 DNS Hygiene
| Hygiene Score | 80% (Excellent) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🛡️ Public Network Snapshot
| Origin ASN | AS19624 |
| Network Prefix | 31.14.40.0/23 |
| Route mapping | Found |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 31% | 2 | 4 |
| routing | 32% | 2 | 3 |
| services | 30% | 2 | 3 |
| ownership | 40% | 3 | 5 |
| reputation | 26% | 1 | 3 |
| geolocation | 35% | 2 | 3 |
| Overall | 32% | 12 | 21 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (70%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-07 12:23:55 UTC |
| Last Seen | 2026-08-26 21:31:20 UTC |
| Profile Built | 2026-08-29 07:27:07 UTC |
| Data Freshness | Live |
| Signal Types | 28 |
| Total Observations | 31 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 31.14.40.92
Who owns the IP address 31.14.40.92?
31.14.40.92 is registered to Andi Cocei. The address falls within the 31.14.40.0/23 network block. Registration is held at RIPE.
Where is 31.14.40.92 located?
Geolocation data places 31.14.40.92 in Romania. The local time zone is Europe/Bucharest. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 31.14.40.92 malicious or safe?
31.14.40.92 currently carries a moderate risk assessment, meaning some indicators warrant caution, but the evidence is mixed. This assessment is generated from continuously collected signals and can change over time.
What is the hostname for 31.14.40.92?
The reverse DNS (PTR) record for 31.14.40.92 is localhost. This hostname is forward-confirmed, meaning it resolves back to the same address.