78.17.93.91
# IP INTELLIGENCE BRIEFING
Target IP: 78.17.93.91/32
Classification: High Risk Tor Exit Node
Risk Score: 70/100
Reporting Period: As of 2026-07-27
---
## EXECUTIVE SUMMARY
IP 78.17.93.91 is a high-risk Tor exit node located in the United Arab Emirates (AE). The address presents significant threat potential for inbound connections and should be blocked at network perimeter. The IP demonstrates Tor exit node characteristics, operates multiple associated IPs in its /24 subnet with elevated abuse density, and shows minimal operator stability.
---
## PROFILE ANALYSIS
Network Classification
- Primary Role: Tor Exit Node
- Risk Score: 70 (High Risk)
- Authority Score: 0/100 (Unknown authority)
- Provider Score: 0/100 (No provider data available)
- Control Plane Score: 0.2174 (Minimal operator confidence)
Geolocation Data
- Country: United Arab Emirates (AE)
- Coordinates: 23.75°N, 54.5°E
- Timezone: Asia/Dubai
- Validation Status: Geo-plausibility flag set to FALSE due to RTT anomalies (observed 26ms vs minimum possible 102.5ms for 5,126km distance)
- Observation Count: 5 probes
Ownership Information
- ASN: 26832
- Organization: Not identified
- Netname: Not identified
- Abuse Contact: Not identified
- Registration Date: Not available
- CIDR Block: 78.17.93.0/24
---
## THREAT INDICATORS
Primary Threat Classification
- Tor Exit Node: CONFIRMED (isTorExit: true)
- Threat Label: Tor Exit Nodes
- Blacklist Status: Listed on 1 blacklist(s)
- DNSBL Status: Listed on 1 of 8 total DNSBL lists
Threat Indicators
- Tor exit node indicators observed
- Not classified as known attacker or spam source
Campaign Correlation
- Likelihood: Not applicable
- Certificate Matches: 0
- Banner Matches: 0
- Correlated IPs: 0
---
## NETWORK SERVICES
Open Ports
| Port | Protocol | Service | Details |
|---|---|---|---|
| 443 | TCP | HTTPS | Web server |
| 22 | TCP | SSH | OpenSSH_9.6p1 Ubuntu-3ubuntu13.18 |
TLS/SSL Certificate
- Issuer: CN=www.w2npyyxm4pcg.com
- Subject: CN=www.c4b3gyhngrxjdbd2gcl.net
- Self-Signed: No
- Certificate Status: Active
DNS Resolution
- PTR Hostname: 91.93.17.78.mtl6.servers.guru
- Forward Resolution: 91.93.17.78.mtl6.servers.guru
- Forward Confirmed: No
- Forward Resolution Count: 1
- Domain: servers.guru
- DMARC: Present
- SPF: Not present
- TXT Record Count: 0
---
## TEMPORAL ANALYSIS
Historical Observations
- Total Observations: 23
- Recent Activity: 2026-07-27
- Threat Persistence Days: 0
- Ownership Changes: 0
- Is Persistently Malicious: No
Recent Signal History
- 2026-07-27 04:13: Ownership stability signal (confidence 0.85)
- 2026-07-27 04:11: Operator score signal - Minimal (0.2174)
- 2026-07-27 04:09: Tor exit node detection confirmed (confidence 0.80)
- 2026-07-26 22:04: Operator score signal - Minimal (0.2174)
The IP exhibits transient threat behavior with no persistent malicious patterns detected.
---
## SUBNET ANALYSIS (78.17.93.0/24)
Neighborhood Risk Profile
- Abuse Density: 0.5 (Moderate)
- Subnet Classification: Mostly Clean
- Total Siblings: 4
- Active Siblings: 2
- Threat Siblings: 2
Neighboring High-Risk IPs
| IP Address | Risk Score | Authority Score |
|---|---|---|
| 78.17.93.70 | 66 | 50 |
| 78.17.93.172 | 70 | 50 |
| 78.17.93.173 | 66 | 50 |
Assessment: The /24 subnet contains 3 additional high-risk IPs with risk scores ranging from 66-70. Two threat siblings were identified, indicating concentrated malicious activity within this subnet.
---
## CONTROL PLANE ANALYSIS
- BGP Prefix: 78.17.93.0/24
- Origin ASN: 26832
- Route Changes (30d): 0
- Is Route Stable: No
- Is Route Origin AS: No
- Is MoAS: No
- RPKI State: Not available
- IRR Consistency: Not available
- DNSSEC Valid: Yes
- Has CAA Records: Yes
---
## RECOMMENDED ACTIONS
Firewall Rules
| Rule Type | Action | Details |
|---|---|---|
| Default | DROP | Block all inbound traffic to 78.17.93.91 |
| Tor Exit Node | DROP | Block identified Tor exit node |
| Neighbor IPs | DROP | Block 78.17.93.70, 78.17
93.172, 78.17.93.173, 78.17.93.173 |
| Outbound Connections | MONITOR | Log all connections to Tor exit nodes |
|---|---|---|
| DNS Queries | DROP | Block DNS resolution to servers.guru subdomains |
Incident Response
- Priority: HIGH
- Classification: Malicious Infrastructure (Tor Exit Node)
- Action Required: Immediate firewall rule deployment recommended
Contextual Notes
- The IP 78.17.93.91 resolves to a Tor exit node with confirmed indicators
- Geolocation data shows validation anomalies (RTT inconsistency)
- DNS records show weak forward confirmation (forwardConfirmed: false)
- SSH service running on port 22 with OpenSSH Ubuntu version
- Multiple threat siblings in /24 subnet indicate coordinated infrastructure
- No persistent malicious behavior detected over observation period
---
End of Intelligence Briefing
*Generated by IPDebrief Intelligence Platform*
*Classification: Internal Use Only*
*Data Current as of: 2026-07-27*
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Abuse contact role object |
| ASN | AS26832 |
| Network Name | moula-world-llc |
| CIDR Block | 78.17.93.0/24 |
| RIR | RIPE |
| Country | US |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | 91.93.17.78.mtl6.servers.guru |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | 91.93.17.78.mtl6.servers.guru |
🔐 DNS Hygiene
| Hygiene Score | 60% (Good) |
| SPF | Not configured |
| DMARC | Present |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Present |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🛡️ Public Network Snapshot
| Origin ASN | AS26832 |
| Network Prefix | 78.17.93.0/24 |
| Route mapping | Found |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 28% | 2 | 5 |
| routing | 17% | 2 | 3 |
| services | 24% | 2 | 3 |
| ownership | 19% | 3 | 4 |
| reputation | 16% | 1 | 3 |
| geolocation | 20% | 2 | 3 |
| Overall | 21% | 12 | 21 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Low (35%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-16 14:01:30 UTC |
| Last Seen | 2026-09-01 00:40:36 UTC |
| Profile Built | 2026-09-01 00:41:26 UTC |
| Data Freshness | Live |
| Signal Types | 27 |
| Total Observations | 32 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 78.17.93.91
Who owns the IP address 78.17.93.91?
78.17.93.91 is registered to Abuse contact role object. The address falls within the 78.17.93.0/24 network block. Registration is held at RIPE.
Where is 78.17.93.91 located?
Geolocation data places 78.17.93.91 in Waterford, M, United States. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 78.17.93.91 malicious or safe?
78.17.93.91 currently carries a moderate risk assessment, meaning some indicators warrant caution, but the evidence is mixed. This assessment is generated from continuously collected signals and can change over time.
What is the hostname for 78.17.93.91?
The reverse DNS (PTR) record for 78.17.93.91 is 91.93.17.78.mtl6.servers.guru. This hostname is not forward-confirmed, so it should be treated as a weak signal.