94.156.152.8📋 Copy

## IP INTELLIGENCE BRIEFING: 94.156.152.8/32

Classification: Tor Exit Node • Risk Score: 59/100 (Moderate) • Status: Active Threat

---

EXECUTIVE SUMMARY

IP address 94.156.152.8 is a Tor exit node originating from South Africa (ZA) under ASN 214209 (INTERNET-MAGNATE-MNT). The address is actively observed as a Tor exit indicator with blacklist presence on 2 DNSBL lists. The /24 subnet shows elevated abuse density at 0.6667, indicating concentrated malicious activity. Two neighboring IPs (94.156.152.18 and 94.156.152.48) exhibit medium-risk scores of 65 and 55 respectively.

---

THREAT PROFILE

Primary Threat Vector: Tor Exit Node Abuse

• Tor Classification: Confirmed (isTor: true)
• Service Status: Firewalled / No Services
• Open Ports: None detected
• Blacklist Count: 1 active listing
• DNSBL Listings: 2/8 total lists

Geolocation: South Africa (ZA)

• Accuracy: 1200km radius
• Geo Validation: Plausible (distance 1650.6km from probe origin)
• RTT: Average 144.2ms

---

NETWORK CONTEXT

ASN Infrastructure: 214209 (INTERNET-MAGNATE-MNT)

• Network Relationships: 65 relationships to INTERNET-MAGNATE network
• Route Stability: False (isRouteStable: false)
• RPKI State: Unverified

/24 Subnet Analysis (94.156.152.0/24):

• Abuse Density: 0.6667 (High)
• Total Siblings: 3
• Active Siblings: 2
• Threat Siblings: 2
• Inherited Risk: 5/100

Neighbor IP Risk Assessment:

---

OBSERVATION HISTORY

Temporal Analysis: 46 historical observations recorded

• Recent Activity: Last observed 2026-06-19T09:04:18Z
• Operator Score: 0.1304 (Minimal)
• Threat Persistence: 0 days (transient threat)
• Campaign Likelihood: None
• Persistence Indicators: Not persistently malicious

---

RECOMMENDED ACTIONS

Immediate Mitigation:

```bash

# BLOCK IP (iptables/nftables)

iptables -A INPUT -s 94.156.152.8/32 -j DROP

nft add rule inet filter input ip saddr 94.156.152.8/32 drop

# BLOCK NEIGHBORS (high-risk /24)

iptables -A INPUT -s 94.156.152.0/24 -j DROP

nft add rule inet filter input ip saddr 94.156.152.0/24 drop

```

Monitoring Recommendations:

• Block the entire 94.156.152.0/24 subnet due to 66.67% abuse density
• Monitor ASN 214209 for similar Tor exit node patterns
• Alert on any connections to 94.156.152.18 or 94.156.152.48

WAF/Cloudflare Rules:

```nginx

# Cloudflare WAF

ip_reputation_action: block

ip_reputation_blocklist: tor_exit_nodes

# AWS WAF

Rule: Block 94.156.152.8/32

Priority: High

```

---

THREAT INTELLIGENCE SUMMARY

This IP represents a confirmed Tor exit node with moderate risk (59/100) and elevated neighborhood abuse density. The subnet's 66.67% abuse rate warrants blocking the entire /24 range. No persistent malicious campaigns detected, but the Tor classification indicates potential anonymized attack traffic. Immediate blocking of 94.156.152.8 and its two neighboring IPs is recommended, along with subnet-level mitigation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.