5.255.105.87📋 Copy

# IP Intelligence Briefing: 5.255.105.87/32

## Executive Summary

IP address 5.255.105.87 is classified as High Risk (Risk Score: 70/100) and operates as a Tor Exit Node originating from The Infrastructure Group (TIG) network in Dronten, Netherlands. This IP presents elevated threat indicators consistent with anonymized traffic sources and should be treated with enhanced scrutiny.

## Technical Profile

Ownership & Infrastructure

Network Classification

• Service Purpose: Single-Service Host
• Infrastructure Type: Tor Exit Node
• Connection Type: Not applicable
• Cloud/CDN/VPN: No
• Hosting/Residential/Mobile: No
• Bogon: No

Threat Indicators

• Primary Indicator: Tor exit indicators observed
• Blacklist Count: 1
• DNSBL Listed: 1 of 8 total lists
• Known Campaigns: None
• Is Known Attacker: No
• Is Spam Source: No
• Is Tor Exit: Yes

DNS & Hostname Analysis

• PTR Hostnames: network.vps.75746359.exit
• Forward Confirmed: No
• Hosted Domains: None
• Forward Resolution Count: 1

Services Exposed

Control Plane Data

• Origin ASN: 60404
• BGP Prefix: 5.255.96.0/19
• AS Path: 6939 60404
• RPKI State: Not available
• Route Changes (30d): 1
• Route Stability: Not stable
• DNSSEC Valid: Yes
• Operator Score: 0.1304 (Minimal)

## Neighborhood Analysis (5.255.105.0/24)

• Abuse Density: 1
• Classification: mostly_clean
• Total Siblings: 2
• Active Siblings: 2
• Threat Siblings: 2
• Inherited Risk: 5
• Notable Neighbor: 5.255.105.182 (Risk Score: 59)

## Observation History (30 Records)

Recent signal observations indicate:

• Route Stability: Minimal concerns
• Operator Score: 0.1304 (Minimal)
• Ownership Changes: 0
• Threat Persistence Days: 0
• Is Persistently Malicious: No
• Threat Observation Count: 1

The IP shows limited persistence and no evidence of long-term malicious campaign activity.

## Relationships Graph

• Same Network: TIG (multiple network-level associations)
• DNS Association: network.vps.75746359.exit (multiple hostname mappings)

## Recommended Actions

Access Control

• Action: Consider enhanced verification for anonymous traffic
• Reason: Tor exit indicators observed
• Severity: Medium

Monitoring

• Action: Increase logging verbosity and review recent activity from this IP
• Reason: Elevated risk score (70/100)
• Severity: High

Firewall Rules

```bash

# iptables

iptables -A INPUT -s 5.255.105.87 -j DROP

# nftables

nft add rule inet filter input ip saddr 5.255.105.87 drop

# nginx

deny 5.255.105.87;

# pfSense

5.255.105.87/32

# Cloudflare WAF

{"description":"Block 5.255.105.87 — IPDebrief risk score 70","action":"block","filter":{"expression":"ip.src eq 5.255.105.87"}}

# AWS WAF

{"Addresses":["5.255.105.87/32"],"Description":"IPDebrief risk 70"}

```

## Intelligence Assessment

This IP address functions as a Tor exit node, providing anonymity to users accessing the internet through the Tor network. The presence of SSH service and Tor exit node functionality indicates potential use for:

• Anonymized command and control communications
• Privacy-focused but potentially malicious traffic
• Legitimate privacy use cases (context-dependent)

The moderate-to-high risk score (70/100) combined with Tor exit node status warrants defensive measures. However, the IP is not persistently malicious, suggesting episodic rather than campaign-based activity.

SOC Recommendation: Implement the recommended firewall rules and enable enhanced logging for traffic from this subnet. Consider implementing behavioral analysis to distinguish between legitimate privacy users and malicious actors. Monitor for correlation with other threat indicators before taking blocking action.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.