62.171.137.169📋 Copy

IP INTELLIGENCE BRIEFING: 62.171.137.169/32

CLASSIFICATION: Moderate Risk – Tor Exit Node Infrastructure

EXECUTIVE SUMMARY

IP 62.171.137.169 is identified as a Tor exit node located in Nuremberg, Germany (AS51167, Johannes Selg). The IP carries a moderate risk score of 49 and is flagged with Tor exit indicators, with one DNSBL listing. No open services were detected during reconnaissance, with the connection classified as "Firewalled / No Services."

TECHNICAL PROFILE

• ASN: 51167 | Organization: Johannes Selg
• Geolocation: Nuremberg, Germany (DE)
• BGP Prefix: 62.171.136.0/23
• PTR Record: vmi343398.contaboserver.net
• DNS Status: Forward confirmed, no SPF/DMARC records
• Network Role: Tor Exit Nodes (confirmed)

THREAT INDICATORS

• Tor Exit Node: Confirmed (isTorExit: true)
• Blacklist Status: 1 DNSBL listing
• Abuse Confidence: Moderate (risk score 49)
• Known Campaigns: None detected
• Known Attacker: False
• Spam Source: False

NETWORK NEIGHBORHOOD ANALYSIS

The /24 subnet (62.171.137.169/24) shows an abuse density of 0, classified as "mostly_clean." One neighboring IP (62.171.137.146) was identified with a risk score of 25 and authority score of 60. The subnet contains 2 active sibling IPs with 2 threat siblings.

HISTORICAL OBSERVATIONS

Forty-seven total observations recorded. Recent signal analysis (2026-06-26 through 2026-06-27) indicates minimal threat activity across multiple observation windows. The IP is not classified as persistently malicious.

NETWORK RELATIONSHIPS

The IP maintains 324 recorded relationships with strong associations to the CONTABO network infrastructure. DNS associations link to vmi343398.contaboserver.net. Multiple same-network relationships confirmed.

RECOMMENDED ACTIONS

1. Allow with monitoring: As a Tor exit node with no active services, the IP poses low direct exploitation risk but may be used for anonymization.

2. Monitor for abuse patterns: Track outbound connections for potential command-and-control or data exfiltration activity.

3. No immediate blocking required: The IP is not flagged as a known attacker or spam source.

4. Review firewall rules: Ensure egress filtering is in place if the receiving environment requires it.

ANALYST NOTES

The IP's classification as a Tor exit node is the primary risk factor. While not malicious in itself, Tor exit nodes are commonly abused for various purposes. The lack of open services and minimal historical threat activity suggests this instance is operating as expected within the Tor network.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.