95.169.191.186
IP Intelligence Briefing: 95.169.191.186
Date: 2026-06-09
---
**Risk Profile**
- Risk Score: 70/100 (High Risk)
- Threat Indicators: Tor exit node activity detected.
- Ownership: Registered to Ivan Gladenko (ASN 31103, RIPE).
- Geolocation: Russia (RU), no city/region specified.
- Network Role: Identified as a Tor exit node, with no associated services or hosting infrastructure.
---
**Observation History**
- Recent Activity (2026-06-09):
- Tor exit node signals observed.
- No persistent malicious activity detected (zero threat persistence days).
- Single observation event linked to Tor exit indicators.
---
**Relationships**
- Linked Entities:
- Subnet RU-KEYWEB (95.169.190.0/23).
- No direct connections to known malicious organizations or domains.
- DNS records point to keyweb.de, with SPF/DMArc configured.
---
**Neighborhood Analysis**
- Subnet: 95.169.191.186/24.
- Abuse Density: 0% (clean subnet).
- Neighbors:
- One sibling IP (95.169.191.176) with low risk (score 25).
- No malicious activity detected in adjacent IPs.
---
**Recommended Actions**
1. Block the IP:
- Implement firewall rules to deny traffic from 95.169.191.186/32 (see tools for rule templates).
- Monitor for associated Tor network traffic patterns.
2. Enhanced Logging:
- Increase verbosity for anonymous traffic and review logs for suspicious behavior.
3. Verify Ownership:
- Confirm Ivan Gladenko’s legitimacy via RDAP and check for historical abuse reports.
---
**Conclusion**
This IP is flagged as a Tor exit node with no direct malicious activity but poses risks due to its association with anonymizing networks. While the subnet is clean, the IP’s high risk score warrants proactive mitigation. Use the provided firewall rules and monitoring recommendations to reduce exposure.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Ivan Gladenko |
| ASN | AS31103 |
| Network Name | — |
| CIDR Block | 95.169.190.0/23 |
| RIR | RIPE |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | h-95.169.191.186.keyweb.de |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | h-95.169.191.186.keyweb.de |
🔐 DNS Hygiene
| Hygiene Score | 60% (Good) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 35% | 2 | 4 |
| routing | 35% | 2 | 3 |
| services | 21% | 2 | 2 |
| ownership | 34% | 3 | 4 |
| reputation | 30% | 1 | 3 |
| geolocation | 32% | 2 | 3 |
| Overall | 31% | 12 | 19 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-22 13:35:49 UTC |
| Last Seen | 2026-06-15 11:53:10 UTC |
| Profile Built | 2026-06-15 11:02:51 UTC |
| Data Freshness | Live |
| Signal Types | 26 |
| Total Observations | 51 |
Full dossier details are available via our API.