95.179.255.150
The IP address 95.179.255.150 was identified as a high-risk asset with a reputation score of 70. Tor exit indicators were observed, and the address was confirmed as an active Tor exit relay. Geolocation data placed the infrastructure in Frankfurt am Main, Hesse, DE, associated with AS20473 (MAINT-AS20473) and the domain vultrusercontent.com. Network scans revealed SSH service (port 22) running on the host.
Threat intelligence sources listed the IP on one blacklist and eight DNSBL entries. Neighborhood analysis within the 95.179.255.0/24 subnet indicated an abuse density of 1 and one active threat sibling. The control plane showed route changes over the last 30 days with minimal operator stability.
Due to the high-risk classification and confirmed Tor exit node functionality, the recommended action was to block the IP address. Firewall rules were generated for iptables, nginx, and pf to deny ingress from this source. The threat actor was classified under anonymization services.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | MAINT-AS20473 |
| ASN | AS20473 |
| Network Name | NET-V4-95-179-128-0-17 |
| CIDR Block | 95.179.254.0/23 |
| RIR | RIPE |
| Country | DE |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | 95.179.255.150.vultrusercontent.com |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | 95.179.255.150.vultrusercontent.com |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Not verified |
| DNSSEC | Not signed |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Single-Service Host |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 22 | ssh | tcp | |
| Closed Ports | 25, 80, 443, 3389, 8080, 8443 (1 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 40% | 2 | 4 |
| routing | 51% | 2 | 5 |
| services | 41% | 2 | 3 |
| ownership | 53% | 3 | 5 |
| reputation | 42% | 1 | 7 |
| geolocation | 40% | 2 | 3 |
| Overall | 44% | 12 | 27 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-09-08 03:38:21 UTC |
| Last Seen | 2026-09-10 11:57:02 UTC |
| Profile Built | 2026-09-10 11:05:39 UTC |
| Data Freshness | Live |
| Signal Types | 28 |
| Total Observations | 42 |
Full dossier details are available via our API.