57.129.91.235📋 Copy

# IP Intelligence Briefing: 57.129.91.235

## Executive Summary

IP address 57.129.91.235 operates as a Tor exit node hosted by OVH GmbH in Frankfurt am Main, Germany. The address carries a moderate risk score (59) and is flagged for Tor exit node activity with one DNSBL listing observed.

## Ownership and Geolocation

• ASN: 16276 (OVH GmbH)
• Organization: OVH GmbH
• Location: Frankfurt am Main, Hesse, Germany (DE)
• CIDR Block: 57.129.0.0/17
• Registration RIR: ARIN

## Threat Indicators

• Tor Exit Node: Confirmed (isTorExit: true)
• Threat Indicators: Tor exit indicators observed
• Blacklist Status: 1 DNSBL listing detected
• Known Campaigns: None identified
• Known Attacker Status: Not flagged
• Spam Source Status: Not flagged

## Network Services

• Open Ports: TCP/22 (SSH) - OpenSSH_9.2p1 Debian variant
• DNS Resolution: exit1.mit-security.at (forward confirmed)
• PTR Record: exit1.mit-security.at
• Email Authentication: SPF and DMARC records present

## Neighborhood Analysis

• Subnet: 57.129.91.235/24
• Subnet Classification: Mostly clean
• Abuse Density: 1
• Threat Siblings: 1 identified
• Control Plane: Route stable (isRouteStable: true), BGP prefix 57.129.0.0/17

## Historical Observations

• Total Observations: 52 signals recorded
• Risk Trend: Consistent moderate risk classification across observation period
• Operator Score: 0.5652 (Moderate)
• Threat Persistence: Not persistently malicious
• Ownership Changes: None observed

## Relationship Graph

• DNS Associations: exit1.mit-security.at
• Network Relationships: PCI-DE1 network segment
• Total Relationships: 256 identified entities

## Risk Assessment

The IP address presents moderate risk primarily due to its function as a Tor exit node. Tor exit nodes are commonly exploited for anonymity-based attacks, though the IP itself is not classified as a known attacker. The consistent moderate risk profile across historical observations indicates stable operational behavior without escalation to high-risk classification.

## Recommended Actions

• Monitoring: Monitor outbound connections from internal networks to this IP
• Egress Filtering: Consider blocking inbound connections to port 22 from this IP
• Threat Hunting: Investigate any connections to this IP for potential Tor-based traffic exfiltration attempts
• DNS Filtering: The hostname "exit1.mit-security.at" may warrant additional scrutiny for command-and-control patterns

## SOC Analyst Notes

While this IP is not actively malicious, its designation as a Tor exit node requires awareness for potential abuse scenarios. The .at domain extension on a German-housed IP suggests potential misconfiguration or repurposing of infrastructure. No active campaign correlation detected.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.