84.239.46.144
IP Intelligence Briefing: 84.239.46.144
Date: 2026-06-09
---
**1. Profile Summary**
- Risk Score: 70 (High Risk)
- Threat Indicators:
- Tor Exit Node: Confirmed as a Tor exit relay.
- DNSSEC Valid: True.
- DNSBL Listed: 1/8 lists.
- Ownership:
- ASN: 201308 (Castlegem SRL, Romania).
- Geolocation: Registered to UK (GB), but ISP is Romanian.
- Network Role:
- Provider: Tor Exit Node.
- Subnet: 84.239.46.0/24.
- Abuse Density: 0 (clean).
---
**2. Observation History**
- Recent Activity:
- Tor Exit Indicators: Observed 1 time in the last 30 days.
- Minimal Risk: Operator score (0.13) and stability score (0).
- Consistency:
- No persistent malicious activity detected.
- ICMP validation failed (firewalled or restricted).
---
**3. Relationships**
- Network Links:
- Same Network: 22 relationships to "CASTLEGEM" (Castlegem SRL, Romania).
- Subnet: 84.239.46.0/24.
- Threat Connections:
- No direct links to known malicious campaigns or organizations.
---
**4. Neighborhood Analysis**
- Subnet: 84.239.46.0/24.
- Neighbor Count: 0 active IPs (no siblings found).
- Abuse Density: 0 (clean subnet).
---
**5. Actionable Insights**
- Threat Context:
- Tor exit nodes are often used for anonymizing traffic but can be abused for C2, data exfiltration, or covert operations.
- The IP’s association with a Romanian ISP and UK geolocation may indicate complex routing or misconfigured infrastructure.
- Recommendations:
- Monitor Traffic: Track outbound connections from this IP for unusual patterns (e.g., encrypted traffic, C2 signatures).
- Block Tor Exit Nodes: Consider blocking all Tor relays in your network if not required.
- Verify Ownership: Confirm Castlegem SRL’s legitimacy and ensure no unauthorized use of their ASN.
---
Conclusion: This IP is a Tor exit node with no direct malicious indicators but warrants monitoring due to its anonymity layer and ownership ties. Verify if it aligns with legitimate Tor usage or if it’s being repurposed for malicious activities.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | MNT-ADNET |
| ASN | AS201308 |
| Network Name | — |
| CIDR Block | — |
| RIR | RIPE |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 34% | 2 | 3 |
| routing | 13% | 1 | 1 |
| services | 15% | 2 | 2 |
| ownership | 24% | 2 | 3 |
| reputation | 30% | 1 | 3 |
| geolocation | 30% | 2 | 3 |
| Overall | 24% | 10 | 15 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-22 13:35:39 UTC |
| Last Seen | 2026-06-26 21:06:48 UTC |
| Profile Built | 2026-06-27 10:35:11 UTC |
| Data Freshness | Live |
| Signal Types | 18 |
| Total Observations | 47 |
Full dossier details are available via our API.