91.235.142.133📋 Copy

# IP Intelligence Briefing: 91.235.142.133/32

Classification: Moderate Risk (59/100)

Date Generated: Current

Analyst: IPDebrief Intelligence Team

---

## Executive Summary

IP 91.235.142.133 operates as a Tor exit node hosted in Kyiv, Ukraine, under ASN 30860 (OWL PROTECT LLC). The address demonstrates confirmed Tor exit node functionality with elevated risk indicators including multiple DNSBL listings. While the /24 subnet remains mostly clean, this specific IP requires monitoring due to its role as an anonymity service endpoint.

---

## Technical Profile

---

## Threat Indicators

• Tor Exit Node: Confirmed active
• DNSBL Listings: 2 of 8 total blacklists flagged
• Maximum Severity: High
• Total Observations: 82 signals recorded
• Known Campaigns: None identified
• Associated Domains: mmsrl.org (PTR hostname)
• TLS Certificate: CN=www.jmaqa5j7ehbfe5s3gef.com (subject CN=www.dotrrs6ueil.net)

---

## Network Context

• Subnet Classification: 91.235.142.0/24
• Abuse Density: Low (1/10 scale)
• Threat Siblings: 1 identified
• Control Plane: BGP prefix 91.235.142.0/24, AS path 3303→30860
• Route Stability: Unstable (1 route change in 30 days)

---

## Observed Services

---

## Historical Activity

Analysis of 82 observations indicates consistent ASN attribution (30860) to prefix 91.235.142.0/24. Recent blacklist activity shows escalating severity, with multiple listings observed in 2026-08-12 timeframe. No persistent malicious campaign signatures detected.

---

## Recommended Actions

Immediate

• Block inbound traffic from this IP on sensitive services (recommended by firewall rules)
• Review recent logs for any outbound connections from internal systems to this address
• Monitor for traffic patterns typical of Tor exit node abuse

Mitigation Rules

```bash

# iptables

iptables -A INPUT -s 91.235.142.133 -j DROP

# nftables

nft add rule inet filter input ip saddr 91.235.142.133 drop

# nginx

deny 91.235.142.133;

```

---

## Intelligence Assessment

This IP represents a standard Tor exit node with moderate risk characteristics. While Tor exit nodes are legitimate infrastructure, they are frequently abused for malicious activities. The elevated risk score (59/100) and multiple blacklist listings warrant defensive blocking at the network perimeter. The /24 neighborhood shows minimal abuse density, suggesting the threat is isolated to this specific endpoint rather than a broader network compromise.

Priority: Medium — Block and monitor.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.