IP Intelligence Briefing: 82.118.248.205
Date: 2026-06-09
---
**1. Core Profile**
- Risk Score: 70 (High Risk)
- Reputation: High Risk (Tor exit node, DNSBL listings)
- Ownership: Registered to MNT-LIR-BG (Bulgaria) under the RIPE registry.
- Geolocation: Sofia, Bulgaria (42.73°N, 25.49°E).
- Network Role: Identified as a Tor exit node with open ports 8080 (http-alt) and 8443 (https-alt).
- Threat Indicators:
- Tor exit node activity observed.
- Listed on 2 DNSBLs (blacklists).
- No known attacker/campaign associations.
---
**2. Observation History**
- Last 30 Days:
- 23 observations logged, with 2 high-severity DNSBL listings (e.g., Spamhaus, Tor exit node).
- Risk score has remained stable at "Minimal" (0.13 operator score).
- Geolocation validation failed due to ICMP blocking, limiting geographic accuracy.
---
**3. Relationships**
- Network: Linked to VIPNET (same network/subnet).
- Certificates: TLS certificate issued to www.otwrz5von4sm37fwn.com (self-signed).
- Services: No HTTP server banners or TLS certificate mismatches detected.
---
**4. Neighborhood Analysis**
- Subnet: 82.118.248.0/24.
- Abuse Density: 0% (clean subnet).
- Neighbors: No active or malicious sibling IPs identified.
---
**5. Recommendations**
- Block Traffic: Implement firewall rules to block traffic from 82.118.248.205 (e.g., `iptables`, Cloudflare WAF).
- Monitor Tor Traffic: Since this is a Tor exit node, inspect traffic exiting through this IP for malicious payloads.
- Check Network: Investigate VIPNET for additional compromised IPs, as the subnet is associated with Tor infrastructure.
- Geolocation Validation: Attempt alternative methods (e.g., passive DNS) to confirm the IPโs geographic origin.
---
Conclusion: This IP is a high-risk Tor exit node in Bulgaria, flagged for abuse but with no direct malicious campaigns or known attacker associations. Immediate blocking and network-wide checks are recommended to mitigate potential risks.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
๐ข Ownership & Registration
| Organization | MNT-LIR-BG |
| ASN | AS45007 |
| Network Name | โ |
| CIDR Block | โ |
| RIR | RIPE |
| Country | โ |
| Abuse Contact | Available via RDAP |
๐ DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No โ PTR hostname does not resolve back to this IP (weak signal) |
๐ DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
โ๏ธ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Multi-Service Host |
| Network Tier | Unknown โ Insufficient routing data to classify |
๐ Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 8080 | http-alt | tcp | โ |
| 8443 | https-alt | tcp | โ |
| Closed Ports | 22, 25, 80, 443, 3389 (2 open / 7 scanned) | ||
| Server | โ |
| HTTP Title | โ |
๐ TLS Certificate
| SANs | None |
| Valid From | 2026-04-22T00:00:00+00:00 |
| Valid Until | 2026-07-04T00:00:00+00:00 |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_256_GCM_SHA384 |
| Signature Algorithm | sha256RSA |
| Validity Period | 73 days |
| Serial Number | 57035A62C085A109 |
| Thumbprint | 0F9DF1E66E5B03D97401C4AC6628A6FBC05341D1 |
๐ฏ Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 27% | 2 | 4 |
| routing | 13% | 1 | 1 |
| services | 15% | 2 | 2 |
| ownership | 24% | 2 | 3 |
| reputation | 26% | 1 | 3 |
| geolocation | 27% | 2 | 3 |
| Overall | 22% | 10 | 16 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
๐ Observation Timeline ๐ Live
| First Seen | 2026-05-22 13:35:46 UTC |
| Last Seen | 2026-06-26 21:06:51 UTC |
| Profile Built | 2026-06-27 16:45:31 UTC |
| Data Freshness | Live |
| Signal Types | 19 |
| Total Observations | 48 |
Full dossier details are available via our API.