64.190.76.10📋 Copy

IP Intelligence Briefing: 64.190.76.10/32

*Generated via IPDebrief Threat Intelligence Platform*

---

**Core Profile**

• Risk Score: 66 (Moderate Risk)
• Threat Indicators:

- Identified as a Tor exit node (confirmed via DNS and geolocation anomalies).

- No known malware campaigns or spam sources linked.

• Geolocation:

- Reported as Italy (IT), but geo-validation flags inconsistencies:

- RTT (Round-Trip Time) of 112ms conflicts with 7,158km distance (minimum expected: 143ms).

- Coordinates suggest Georgia (region) but city is listed as "Decatur" (likely spoofed).

• Network Role:

- Tor exit node (BGP path: 6939 64445 214094).

- No active services or TLS certificates detected.

---

**Observation History**

• Last 30 Days:

- Consistent signal observation (34 total records).

- Stability score: 0.4783 (Basic operator risk score).

- No significant changes in threat or network behavior.

• Key Findings:

- Tor exit node activity has persisted without notable fluctuations.

- Geo-validation anomalies persist, suggesting potential spoofing or misattribution.

---

**Relationships & Context**

• Linked Entities:

- DNS: Resolves to `stracchino.exit.osservatorionessuno.org` (Tor exit node).

- Network: Associated with OSSERVATORIO-NESSUNO (ASN 214094).

- Subnet: 64.190.76.0/24 (abuse density: 14.3%).

• Neighbor Analysis:

- Subnet contains 1 high-risk neighbor (64.190.76.2, risk score 80) and 6 medium-risk IPs.

- Overall subnet classification: Clean but with elevated risk in specific IPs.

---

**Recommended Actions**

1. Block Tor Exit Nodes:

- Apply firewall rules to block traffic from Tor exit nodes (e.g., `iptables -A INPUT -s 64.190.76.0/24 -j DROP`).

2. Monitor Subnet:

- Track high-risk neighbors (e.g., 64.190.76.2) for suspicious activity.

3. Verify Geolocation:

- Investigate geo-validation discrepancies to confirm IP authenticity.

4. DNS Monitoring:

- Watch for DNS requests to `osservatorionessuno.org` or related domains.

---

Conclusion:

The IP is a Tor exit node with moderate risk, linked to a suspicious network and DNS entity. While the subnet is largely clean, the presence of high-risk neighbors and geo-validation anomalies warrants further investigation. Prioritize blocking Tor traffic and monitoring associated networks for potential malicious activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.