96.27.198.133📋 Copy

## IP Intelligence Briefing: 96.27.198.133/32

Classification: Low Risk (Score: 25/100)

Date of Analysis: Current

Jurisdiction: United States (Newark, NJ)

Executive Summary

Target IP 96.27.198.133 is classified as a Tor Exit Node with low-risk characteristics. The address is hosted on WideOpenWest infrastructure (ASN 12083) and is listed on 1 of 8 DNS blacklists with basic operator scoring. No active services or open ports were detected during scanning. The surrounding /24 subnet shows clean classification with zero abuse density, indicating this IP is not part of a broader malicious cluster.

Risk Assessment

• Overall Risk Score: 25 (Low Risk)
• Operator Score: 0.2609 (Basic)
• DNSBL Listings: 1/8 (Low severity)
• Reputation: Low Risk
• Stability: No ownership changes detected

Technical Profile

Geolocation:

• Country: United States (US)
• Region: New Jersey (US-NJ)
• City: Newark
• ASN: 12083
• BGP Prefix: 96.27.198.0/24

DNS Resolution:

• PTR Hostname: d27-96-133-198.evv.wideopenwest.com
• Domain: wideopenwest.com
• Forward Resolution: Confirmed

Network Services:

• Open Ports: None detected
• TLS Certificates: None
• HTTP/HTTPS: No active services
• Server Banner: None

Threat Indicators

• Classification: Tor Exit Node
• Threat Feeds: No active threat indicators
• Campaign Correlation: None identified
• Blacklist Status: Listed on 1 DNSBL (severity: high)

Observation History

Sixteen signal observations recorded. Most recent activity observed 2026-07-21. Consistent Tor exit node classification across observation windows. No escalation in threat severity noted.

Neighborhood Analysis

Subnet 96.27.198.0/24 classification: Clean

• Abuse Density: 0
• Threat Siblings: 0
• Active Siblings: 0
• Total Siblings: 1

No neighboring IPs identified as malicious.

Related Entities

• DNS Association: d27-96-133-198.evv.wideopenwest.com (WideOpenWest)
• No organizational or certificate relationships detected.

Recommended Actions

No immediate action required based on current risk profile. However, the following considerations apply:

1. Traffic Monitoring: Monitor for Tor traffic patterns and potential abuse of exit node functionality

2. DNSBL Review: Investigate the specific blacklist listing to determine if false positive or legitimate abuse

3. Baseline Establishment: Establish traffic baseline for legitimate Tor usage vs. malicious activity

4. Periodic Review: Re-evaluate classification during scheduled threat intelligence cycles

Intelligence Conclusion

This IP represents a Tor exit node with minimal threat characteristics. While Tor exit nodes can be leveraged for malicious activity, the low-risk score, clean neighborhood, and absence of active services suggest limited immediate threat. Recommend monitoring rather than blocking to avoid legitimate user impact, while maintaining awareness of potential abuse vectors.

Analyst Notes: WideOpenWest is a residential ISP provider. Tor exit nodes on residential infrastructure may indicate legitimate privacy usage or abuse. Context-dependent policy application advised.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.