51.158.151.177📋 Copy

# IP Intelligence Briefing: 51.158.151.177/32

Classification: Moderate Risk (Score: 49/100)

Date Generated: [Current Date]

Primary Classification: Tor Exit Node

---

## Executive Summary

IP address 51.158.151.177 is identified as a Tor exit node operating from Paris, France (ASN 12876 / Mickael Marchand). The IP presents moderate risk (score 49) due to anonymous traffic characteristics inherent to Tor infrastructure. Current threat indicators show Tor exit node activity with 1 blacklist listing across 8 total DNSBL lists. The IP maintains a stable network role with web server services (HTTP/HTTPS) and SSH access enabled.

---

## Technical Profile

Network Ownership:

• ASN: 12876 (Mickael Marchand)
• Organization: Mickael Marchand
• RIR: RIPE NCC
• BGP Prefix: 51.158.128.0/17
• Route Stability: Confirmed (isRouteStable: true)

Geolocation:

• Country: France (FR)
• Region: Île-de-France (IDF)
• City: Paris
• Coordinates: 49.38°N, 3.85°E
• Geo Confidence: High (geoConsensus: true, geoPlausible: true)

DNS Resolution:

• PTR Hostname: 51-158-151-177.rev.poneytelecom.eu
• Domain: poneytelecom.eu
• Forward Resolution: Confirmed (1 hostnames)

Active Services:

TLS Certificate:

• Issuer: Let's Encrypt (CN=E8, O=Let's Encrypt, C=US)
• Subject: CN=dedibox.esponde.net
• Subject Alternative Names: dedibox.esponde.net, dl.esponde.net, infiltro.esponde.net, joel.esponde.net, kantuz.esponde.net (+3 more)

---

## Threat Indicators

Primary Risk Factor: Tor Exit Node Activity

• `isTor`: true
• Tor Exit Node Indicators: Observed
• Abuse Confidence Score: Not assigned (null)
• Known Attacker Status: False
• Spam Source Status: False
• Blacklist Count: 1
• Known Campaigns: None detected

Control Plane Metrics:

• Operator Score: 0.5217 (Moderate)
• DNSBL Listed: 1/8 total lists
• Route Changes (30d): 0
• MoAS Status: False

---

## Observation History Analysis

Total Observations: 56 signals recorded

Recent Signal Trends:

• June 26-28, 2026: Multiple observations recorded
• Signal Type 2349 (Operator/Peering): Minimal risk level, raw score 0.15
• Signal Type 15 (Comprehensive): 6 dimensions covered across 7 sources
• Confidence Levels: 0.24-0.60 across observations
• No persistent malicious activity detected (isPersistentlyMalicious: false)
• Threat Persistence Days: 0

Temporal Analysis:

• Ownership Changes: 0
• Data Sufficiency: High (6/6 dimensions covered in recent observations)
• No escalation trend observed in historical data

---

## Network Relationships & Infrastructure

Relationship Graph: 372 relationship entries identified

Key Associations:

• Network: SCALEWAY-AMS (multiple instances)
• DNS: rev.poneytelecom.eu hostname associations
• Infrastructure Type: Tor exit node cluster

Network Neighborhood (51.158.151.0/24):

• Subnet Abuse Density: 0
• Classification: mostly_clean
• Threat Siblings: 1
• Active Siblings: 1
• Total Siblings: 1
• Inherited Risk Score: 2

---

## Recommended Security Actions

Access Control Recommendation:

• Category: Access Control
• Action: Consider enhanced verification for anonymous traffic
• Severity: Medium
• Reason: Tor exit indicators observed

Firewall Implementation Rules:

iptables:

```bash

iptables -A INPUT -s 51.158.151.177 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 51.158.151.177 drop

```

nginx:

```nginx

deny 51.158.151.177;

```

pfSense:

```

51.158.151.177/32

```

Cloudflare WAF:

```json

{"description": "Block 51.158.151.177 — IPDebrief risk score 49", "action": "block", "filter": {"expression": "ip.src eq 51.158.151.177"}}

```

AWS WAF:

```json

{"Addresses": ["51.158.151.177/32"], "Description": "IPDebrief risk 49"}

```

---

## SOC Analyst Assessment

Risk Level: Moderate (49/100)

Threat Characterization: This IP represents a Tor exit node, which is expected infrastructure behavior rather than active malicious activity. The moderate risk score reflects the anonymity characteristics of Tor exit nodes, which can be exploited by threat actors to mask their origin.

Recommended Response:

1. Implement traffic filtering if anonymous traffic violates organizational policies

2. Consider enhanced verification for traffic from this IP if business-critical services are exposed

3. Monitor for any changes in threat indicators or campaign activity

4. Note that the subnet shows low abuse density (0), indicating this IP is part of a relatively clean infrastructure segment

Campaign Correlation: No known campaigns or cert matches detected. Banner matches: 0. Correlated IPs: 0.

Action Priority: Medium severity. Implementation of blocking rules is recommended per organizational policy regarding Tor exit nodes, but business impact should be assessed before enforcement.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.