66.78.40.91📋 Copy

IP Intelligence Briefing: 66.78.40.91

Date: 2026-06-10

---

**1. Core Profile**

• Risk Score: 40 (Moderate Risk)
• Ownership:

- ASN: 21769 (Aokigahara SRL, US)

- Subnet: 66.78.40.0/24

- Geolocation: Wilmington, Delaware, US (no precise coordinates)

• Threat Indicators: Clean (no malicious indicators, blacklists, or campaigns).
• Network Role: Identified as a Tor Exit Node (provider: Tor Exit Nodes).
• DNS:

- Linked to `tor-exit-usa.bronk-ict.nl` (forward-resolved).

- SPF/DMARC records present but no email auth issues.

---

**2. Observation History**

• Recent Activity (2026-06-10):

- Consistent network prefix observations (AS21769, AS215659).

- Location data tied to Wilmington, DE, with a 2500km accuracy radius.

- Behavioral data: No direct honeypot hits, but flagged as a Tor exit node.

---

**3. Relationships**

• Key Associations:

- Same Network: 66.78.40.0/24 (Aokigahara SRL).

- DNS: `tor-exit-usa.bronk-ict.nl` (linked to the IP).

- Threat Context: No direct malicious relationships, but Tor exit nodes are often used for illicit traffic.

---

**4. Neighborhood Analysis**

• Subnet: 66.78.40.0/24 (abuse density: 0%).
• Neighbors:

- 66.78.40.42: Risk score 50 (higher than the IP).

- Subnet classification: "clean," but Tor exit nodes may introduce risk via third-party usage.

---

**5. Threat Narrative**

• Primary Risk: While the IP itself shows no direct malicious indicators, its role as a Tor exit node raises concerns. Tor networks are frequently used for covert communication, data exfiltration, and command-and-control (C2) activities.
• Neighbor Risk: The subnet contains one higher-risk IP (66.78.40.42), suggesting potential for lateral movement or shared infrastructure.
• Recommendations:

- Monitor traffic from this IP for unusual outbound connections (e.g., to known malicious domains).

- Investigate the Tor exit node's association with `tor-exit-usa.bronk-ict.nl` for potential misuse.

- Consider blocking or restricting traffic from the subnet due to the presence of higher-risk neighbors.

Conclusion: This IP is low-risk on its own but warrants scrutiny due to its Tor exit node role and subnet context. SOC teams should prioritize monitoring for indirect threats tied to Tor-based activities.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.