78.17.93.173📋 Copy

# IP INTELLIGENCE BRIEFING: 78.17.93.173/32

Classification: Moderate Risk – Tor Exit Node

Date: Current Intelligence Cycle

Risk Score: 59/100

---

## EXECUTIVE SUMMARY

IP 78.17.93.173 has been classified as a Tor exit node with moderate risk characteristics. The IP exhibits persistent anonymity network activity with associated threat indicators including Tor exit node classification and a single DNS blacklist listing. Network neighborhood analysis reveals elevated abuse density across the 78.17.93.0/24 subnet with multiple sibling IPs showing comparable risk profiles.

---

## TECHNICAL PROFILE

Network Classification:

• ASN: 26832 (moula-world-llc)
• CIDR Block: 78.17.93.0/24
• RIR: RIPE
• Network Role: Tor Exit Nodes

Geolocation:

• Country: US (Waterford)
• Validation Status: GeoPlausible: FALSE
• RTT Violation: Observed RTT 31.0ms violates minimum possible 102.5ms for 5,126km distance

DNS Analysis:

• PTR Hostname: 173.93.17.78.mtl6.servers.guru
• Forward Resolution: servers.guru
• DNSSEC: Valid
• Email Auth: DMARC configured, SPF absent

Service Status:

• Open Ports: None detected
• HTTP/TLS Services: Inactive
• Infrastructure Type: Unknown

---

## THREAT INDICATORS

Threat Feed Observations:

• Tor exit indicators observed in historical analysis
• Persistent classification across 56 observation cycles
• No correlation to known attacker campaigns

---

## NEIGHBORHOOD ANALYSIS

Subnet: 78.17.93.0/24

Abuse Density: 0 (Mostly Clean)

Total Siblings: 4

Active Siblings: 4

Threat Siblings: 4

High-Risk Sibling IPs:

• 78.17.93.70 (Risk: 59/100, Authority: 50)
• 78.17.93.91 (Risk: 66/100, Authority: 50)
• 78.17.93.172 (Risk: 66/100, Authority: 50)

Assessment: All sibling IPs exhibit elevated risk scores consistent with Tor exit node activity, suggesting coordinated anonymization infrastructure within this /24 block.

---

## OBSERVATION HISTORY

Total Observations: 56

Threat Persistence: Non-persistent (single observation cycle)

Recent Classifications: Consistent Tor Exit Node designation across historical data

Temporal Trends: No significant escalation or de-escalation of risk profile observed. Persistent classification indicates stable operational posture rather than emerging threat.

---

## RECOMMENDED ACTIONS

Immediate Actions:

1. Access Control: Implement enhanced verification for anonymous traffic originating from this IP range

2. Logging: Increase logging verbosity and enable detailed activity monitoring for 78.17.93.0/24

3. Firewall Consideration: Block traffic from identified high-risk sibling IPs if policy permits

Implementation Rules:

iptables:

```bash

iptables -A INPUT -s 78.17.93.173 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 78.17.93.173 drop

```

nginx:

```nginx

deny 78.17.93.173;

```

Cloudflare WAF:

```json

{"description":"Block 78.17.93.173 — IPDebrief risk score 59","action":"block","filter":{"expression":"ip.src eq 78.17.93.173"}}

```

AWS WAF:

```json

{"Addresses":["78.17.93.173/32"],"Description":"IPDebrief risk 59"}

```

---

## ANALYST NOTES

Strength of Evidence: Moderate

The IP exhibits clear Tor exit node characteristics with consistent classification across multiple observation cycles. However, geolocation validation failures and absence of active services suggest the IP may be in a dormant or transitional state.

Risk Mitigation Priority: Medium

While not actively malicious based on current indicators, the Tor exit node classification warrants monitoring. Consider implementing rate limiting rather than outright blocking if service availability requires.

Monitoring Recommendation: Continue surveillance of the 78.17.93.0/24 subnet for changes in threat indicators or emergence of active service signatures.

---

Classification: WORK PRODUCT

Distribution: SOC Team, Network Security Operations

Intel Cycle: Real-time

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.