87.121.52.101📋 Copy

# IP Intelligence Briefing: 87.121.52.101/32

Classification: MODERATE RISK — Tor Exit Node Infrastructure

Date: 2026-08-10

Risk Score: 59/100

## Executive Summary

IP 87.121.52.101 is identified as a Tor exit node hosting web services (HTTP/HTTPS) and SSH. The IP exhibits moderate-risk characteristics with Tor exit node indicators, multiple DNSBL listings, and recent blacklist activity. The IP resides in Bulgaria under ASN 34224 (Hrisian Petkov/VPSBG).

## Technical Profile

## Observed Services & Infrastructure

• Open Ports: 80/TCP (HTTP), 443/TCP (HTTPS), 22/TCP (SSH)
• TLS Certificate: CN=www.oj7cgbt5.net (subject), issuer CN=www.uaqcyo3s7qprr.com
• Network Role: Web Server / Tor Exit Node
• Geolocation: Sofia region (42.73°N, 25.49°E), RTT 130-134ms from probe origin

## Threat Intelligence Observations

• Tor Exit Node: Confirmed Tor exit node indicator present
• Blacklist Status: Listed on 2 DNSBLs out of 8 monitored lists
• Recent Activity: 68 total observations recorded
• Abuse Signals: Elevated severity listings observed in recent timeframe (medium to high)
• Operator Score: 0.2609 (Basic classification)

## Neighborhood Context

The /24 subnet (87.121.52.0/24) shows:

• Abuse Density: 0
• Classification: mostly_clean
• Active siblings: 1
• Threat siblings: 1

## Recommended Actions

Access Control:

• Implement enhanced verification for anonymous traffic from this IP
• Consider blocking or rate-limiting Tor exit node traffic

Monitoring:

• Increase logging verbosity for traffic from this IP address
• Review recent connection activity and request patterns

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 87.121.52.101 -j DROP

# nftables

nft add rule inet filter input ip saddr 87.121.52.101 drop

# Nginx

deny 87.121.52.101;

# Cloudflare WAF

{"description": "Block 87.121.52.101 — IPDebrief risk score 59", "action": "block", "filter": {"expression": "ip.src eq 87.121.52.101"}}

# AWS WAF

{"Addresses": ["87.121.52.101/32"], "Description": "IPDebrief risk 59"}

```

## Assessment

This IP should be treated as a moderate-risk source requiring monitoring rather than immediate blocking. The Tor exit node classification indicates potential abuse for anonymized malicious traffic. However, the IP is not flagged as a known attacker or confirmed spam source. Implement firewall rules with appropriate logging to enable correlation of suspicious activity patterns.

---

*Report generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.