89.147.110.251📋 Copy

IP Intelligence Briefing: 89.147.110.251

Date: 2026-06-09

---

**1. Core Risk Profile**

• Risk Score: 70/100 (High Risk)
• Threat Indicators:

- Tor exit node activity detected.

- Linked to hostname `tor-exit-arcticfrost.ufodns.com` (DNS association).

• Ownership:

- ASN: 44925 (Mordur Aslaugarson).

- Geolocation: Boston, Massachusetts, US.

• Network Role:

- Identified as a Tor exit node (provider: Tor Exit Nodes).

- Open SSH service (port 22) with banner `SSH-2.0-OpenSSH_10.0p2`.

---

**2. Observation History**

• Recent Activity (Last 30 Days):

- 1 observation logged (confidence: 85%).

- Consistent Tor exit node signaling.

- No significant changes in risk profile.

---

**3. Relationships & Connections**

• Linked Entities:

- Hostname: `tor-exit-arcticfrost.ufodns.com` (DNS PTR confirmed).

- Network: Subnet `89.147.110.251/24` (abuse density: 0%).

- ASN: 44925 (Mordur Aslaugarson).

• Subnet Neighbors (89.147.110.0/24):

- 5 total IPs; 2 flagged as medium/high risk (e.g., 89.147.110.82, 89.147.110.118).

- No immediate abuse patterns detected in the subnet.

---

**4. Threat & Security Context**

• Tor Exit Node:

- Tor exit nodes are often used for anonymizing traffic but can be exploited for malicious activities (e.g., data exfiltration, command-and-control).

- This IP’s SSH service may represent a potential entry point.

• Actionable Recommendations:

- Block the IP in firewalls (rules provided).

- Monitor SSH traffic to/from this IP for suspicious patterns.

- Investigate the associated hostname (`tor-exit-arcticfrost.ufodns.com`) for malicious domains.

---

**5. Security Actions**

• Firewall Rules (Example):

- `iptables -A INPUT -s 89.147.110.251 -j DROP`

- AWS WAF: Block `89.147.110.251/32` with description "IPDebrief risk 70".

• Monitoring:

- Increase logging verbosity for traffic originating from this IP.

---

**Conclusion**

This IP is a Tor exit node with high-risk indicators, warranting immediate blocking and closer scrutiny. While the subnet shows no widespread abuse, the Tor association and SSH service necessitate proactive defense measures. SOC teams should validate this IP against internal threat feeds and correlate it with ongoing investigations.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.