46.183.216.217📋 Copy

# IP Intelligence Briefing: 46.183.216.217/32

## Executive Summary

IP address 46.183.216.217 is classified as High Risk (Risk Score: 70/100) with confirmed Tor exit node activity. The IP is associated with Latvian infrastructure (RIXHOST) and presents a medium threat severity primarily due to anonymous traffic indicators. Immediate monitoring and access control enhancements are recommended.

## Technical Profile

Ownership & Geolocation

• ASN: 52048 (RIXHOST)
• Organization: lir-lv-siadc-1-MNT
• Network: 46.183.216.0/24
• Country: Latvia (LV)
• City: Riga (56.95°N, 24.1°E)
• RIR: RIPE

Network Classification

• Role: Tor Exit Nodes
• Services: Firewalled / No Services (no open ports detected)
• DNS: PTR hostname ip-216-217.dataclub.info, domain dataclub.info
• Blacklist Status: Listed on 1 blacklist (dnsblListedCount: 1)

Risk Indicators

• Tor Exit Node: Confirmed (isTorExit: true)
• Known Attacker: No
• Spam Source: No
• Abuse Confidence Score: Not available
• Operator Score: 0.1304 (Minimal)

## Observation History

Analysis of 20 signal observations reveals:

• Recent Activity: Signals observed as recent as 2026-07-25T09:12:17
• Persistence: 0 threat persistence days (not persistently malicious)
• Threat Observations: 1 total
• Geolocation Consensus: Validated with 5 probes, 1224.9km distance from origin, 115-122ms RTT
• Subnet Context: 46.183.216.0/24 classified as "mostly_clean" with abuse density of 1, inherited risk score of 2

## Relationship Graph

• Network Relationships: 2 associations with RIXHOST
• DNS Associations: 5 associations with ip-216-217.dataclub.info
• No: Organization, hostname, or certificate relationships beyond DNS

## Neighborhood Analysis (46.183.216.0/24)

• Total Siblings: 1
• Active Siblings: 0
• Threat Siblings: 1
• Abuse Density: 0
• Classification: mostly_clean

## Recommended Actions

Access Control

• Action: Consider enhanced verification for anonymous traffic
• Reason: Tor exit indicators observed
• Severity: Medium

Monitoring

• Action: Increase logging verbosity and review recent activity from this IP
• Reason: Elevated risk score (70/100)
• Severity: High

Firewall Rules

iptables:

```bash

iptables -A INPUT -s 46.183.216.217 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 46.183.216.217 drop

```

nginx:

```nginx

deny 46.183.216.217;

```

pfSense:

```

46.183.216.217/32

```

Cloudflare WAF:

```json

{

"description": "Block 46.183.216.217 — IPDebrief risk score 70",

"action": "block",

"filter": {

"expression": "ip.src eq 46.183.216.217"

}

}

```

AWS WAF:

```json

{

"Addresses": ["46.183.216.217/32"],

"Description": "IPDebrief risk 70"

}

```

## Intelligence Assessment

This IP represents a Tor exit node infrastructure in Latvia. The primary threat vector is anonymous traffic routing, which could be used for:

• Concealing attacker identities
• Bypassing geographic restrictions
• Proxying malicious traffic

The subnet shows minimal inherited risk with no active sibling threats currently detected. However, the confirmed Tor exit node status warrants defensive blocking or enhanced monitoring depending on organizational risk tolerance.

Recommendation: Block at perimeter firewall if Tor traffic is not required for legitimate operations. Implement enhanced logging for any traffic that does traverse.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.