5.255.105.182📋 Copy

# IP Intelligence Briefing: 5.255.105.182/32

Date: 2026-07-23

Classification: Moderate Risk

Risk Score: 59/100

---

## Executive Summary

IP address 5.255.105.182 is registered to The Infrastructure Group (TIG) in Dronten, Netherlands. The address is identified as a Tor exit node with moderate-risk indicators. It operates web services (HTTP/HTTPS) and SSH, and has been associated with 2 DNSBL listings across 8 total threat feeds. Immediate blocking is recommended pending contextual analysis of incoming traffic.

---

## Ownership and Infrastructure

BGP Route Stability: Route is stable with AS Path 6939 → 60404. DNSSEC validation is valid.

---

## Threat Indicators

Primary Concern: Active Tor exit node status presents elevated risk for anonymous traffic, potential command-and-control communication, and spoofed identity attacks.

---

## Network Services and Fingerprinting

Open Ports:

• TCP/80 (HTTP)
• TCP/443 (HTTPS)
• TCP/22 (SSH - OpenSSH_10.0p2 Debian)

TLS Certificate Analysis:

• Issuer: CN=www.2dv324rwdfyz2s6c7s.com
• Subject: CN=www.nx4kx64r7ubjnp55urfm.net
• Certificate is self-signed with mismatched subject/issuer — potential indicator of misconfiguration or malicious intent.

---

## Neighborhood Analysis (5.255.105.0/24)

Neighbor IP: 5.255.105.87 (Risk Score: 0) — clean adjacent address.

---

## Historical Activity (63 Observations)

Recent signals indicate:

• 2026-07-23 03:53: Listed on 2 DNSBLs (max severity: high)
• 2026-07-23 03:47: Operator score 0.2609 (Basic classification)
• 2026-07-23 04:09: Subnet abuse density 0.5, classification mostly_clean

No persistent malicious patterns detected. Threat observation count: 1.

---

## Recommended Actions

Access Control

• Enhanced verification required for anonymous traffic from this IP (Tor exit indicators)
• Consider blocking at perimeter if no legitimate Tor access policy exists

Monitoring

• Increase logging verbosity for traffic from 5.255.105.182
• Review recent activity for potential command-and-control or data exfiltration patterns

Firewall Rules

iptables:

```bash

iptables -A INPUT -s 5.255.105.182 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 5.255.105.182 drop

```

nginx:

```nginx

deny 5.255.105.182;

```

Cloudflare WAF:

```json

{

"description": "Block 5.255.105.182 — IPDebrief risk score 59",

"action": "block",

"filter": {

"expression": "ip.src eq 5.255.105.182"

}

}

```

AWS WAF:

```json

{

"Addresses": ["5.255.105.182/32"],

"Description": "IPDebrief risk 59"

}

```

---

## Relationship Graph

83 relationships identified, primarily "Same Network" type connections to TIG infrastructure. No cross-network or organizational relationships detected.

---

## Analyst Notes

The IP is a Tor exit node with moderate-risk classification. While not flagged as a known attacker or spam source, the combination of Tor exit node status, self-signed TLS certificate with mismatched subject/issuer, and DNSBL listings warrants defensive measures. The subnet shows mixed risk (abuse density 0.5), with one sibling IP (5.255.105.87) showing clean status. SOC teams should evaluate business requirements for Tor access before implementing block rules.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.