Tor exit node: traffic belongs to many anonymous users.
- Tor exit
- true
Verdict
MALICIOUSHigh confidence
3Supporting signals
3Independent sources
3Recent observations
98 / 100Threat score
Why the engine decided this
Deterministic engine · activity high- ABUSEIPDB_HIGH_CONFIDENCE AbuseIPDB abuse confidence score is 75% or higher.
- VT_MODERATE_DETECTION_RATIO 10-29% of VirusTotal vendors flag the indicator.
- GREYNOISE_MALICIOUS GreyNoise classifies the IP's scanning as malicious.
- Tor exit node: the traffic comes from anonymous Tor users, not the relay operator; blocking one exit also blocks legitimate Tor users, so apply an organisation-wide Tor policy.
Key indicators
- IP address
- 185.220.100.243
- ASN
- AS205100
- Holder
- F3NETZE F3 Netze e.V.
- Country
- Germany (DE)
- Network
- TOR-EXIT
- Prefix
- 185.220.100.0/24
- ISP
- Network for Tor-Exit traffic.
- Usage
- Data Center/Web Hosting/Transit
- Open ports
- 22, 80, 9001, 9200, 10050
- Tor exit
- Yes
- First seen
- Not reported by any source
- Last seen
- 2026-09-30 (0 days before)
Relationship graph
Expand| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
 AbuseIPDB | 100% abuse confidence from 204 reporters, newest today; web app attack, hacking, brute-force. | 100% | 0 days recent | Strong |
 VirusTotal | 15/91 vendors (16.5%) flag it: moderate multi-vendor detection, well short of a majority. | 15/91 | 0 days recent | Moderate |
 GreyNoise | Observed scanning the internet, classified malicious, today. | — | 0 days recent | Suspicious |
| IOCSCAPE knowledge base | Tor exit node: traffic belongs to many anonymous users. | — | — | Context |
 RDAP | Network TOR-EXIT (185.220.100.240 - 185.220.100.255), DE; F3NETZE, F3Netze NOC, F3 Netze e.V.. | — | — | Context |
 RIPEstat | Announced in 185.220.100.0/24 by AS205100 (F3NETZE F3 Netze e.V.). | — | — | Context |
 Shodan | Open ports 22, 80, 9001, 9200, 10050. | — | — | Context |
 Tor exit list | Listed as an active Tor exit node. | — | 1 day recent | Context |
 AlienVault OTX | Referenced in 50 community pulses, which are unverified. | — | — | Neutral |
Coverage · checked, no record: ThreatFox, URLhaus, Feodo Tracker, Emerging Threats, DShield · failed: none
Analyst summary
Consistent with engineMalicious: a listed Tor exit node, treated as a malicious traffic source by policy. 100% abuse confidence from 204 reporters, newest today; web app attack, hacking, brute-force. Reported abuse adds to that. The traffic is from anonymous Tor users, not the relay operator.
Why the evidence points to malicious
- [AbuseIPDB] 100% abuse confidence from 204 reporters, newest today; web app attack, hacking, brute-force.
- [GreyNoise] Observed scanning the internet, classified malicious, today.
- [VirusTotal] 15/91 vendors (16.5%) flag it: moderate multi-vendor detection, well short of a majority.
A Tor exit relays many users' traffic; the attacker cannot be identified from this IP.
Attribution
Traffic from a Tor exit belongs to anonymous Tor users; it does not implicate the relay operator.
Written by rules from the engine's evidenceSuggested pivots
Threat context
Context onlyNo group is directly linked to this indicator by any source.
ATT&CK techniques reported
Reported targets: Finance, Defense, Industrial, Government, technology, financial-services, United States of America, Turkey, Ukraine, Romania, Czechia, United Kingdom of Great Britain and Northern Ireland, Norway, Lithuania, Estonia, Latvia
Reports mentioning it
- 2026-09-30 Webscanners 2018-02-09 thru current day
- 2026-09-30 Rogue Robot (S3#)
- 2026-09-30 Honeypot Data – T-Pot - Sydney, Australia - August 2026
- 2026-09-30 Honeypot Data – T-Pot - Sydney, Australia - September 2026
- 2026-09-30 Rogue Robot (S3#)
All evidence
14 sources queried · click a row for its raw fields · ages computed by the engine| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| AbuseIPDB | 100% abuse confidence from 204 reporters, newest today; web app attack, hacking, brute-force. | 100% | 0 days recent | Strong |
| VirusTotal | 15/91 vendors (16.5%) flag it: moderate multi-vendor detection, well short of a majority. | 15/91 | 0 days recent | Moderate |
| GreyNoise | Observed scanning the internet, classified malicious, today. | — | 0 days recent | Suspicious |
| IOCSCAPE knowledge base | Tor exit node: traffic belongs to many anonymous users. | — | — | Context |
| RDAP | Network TOR-EXIT (185.220.100.240 - 185.220.100.255), DE; F3NETZE, F3Netze NOC, F3 Netze e.V.. | — | — | Context |
| RIPEstat | Announced in 185.220.100.0/24 by AS205100 (F3NETZE F3 Netze e.V.). | — | — | Context |
| Shodan | Open ports 22, 80, 9001, 9200, 10050. | — | — | Context |
| Tor exit list | Listed as an active Tor exit node. | — | 1 day recent | Context |
| AlienVault OTX | Referenced in 50 community pulses, which are unverified. | — | — | Neutral |
 ThreatFox | No record. | — | — | No record |
| URLhaus | No record. | — | — | No record |
| Feodo Tracker | No record. | — | — | No record |
 Emerging Threats | No record. | — | — | No record |
| DShield | Not among the 1,000 IPs most reported by DShield sensors today. | — | — | No record |
Engine rules applied
- ABUSEIPDB_HIGH_CONFIDENCEAbuseIPDB abuse confidence score is 75% or higher.
- VT_MODERATE_DETECTION_RATIO10-29% of VirusTotal vendors flag the indicator.
- GREYNOISE_MALICIOUSGreyNoise classifies the IP's scanning as malicious.
- RECENT_MALICIOUS_ACTIVITYStrongest malicious evidence is 30 days old or less.
- MULTIPLE_CORROBORATING_SOURCESTwo or more independent source families agree.
- TOR_EXIT_NODEIP is a currently listed Tor exit node; traffic belongs to many anonymous users.
Engine notes
- Tor exit node: the traffic comes from anonymous Tor users, not the relay operator; blocking one exit also blocks legitimate Tor users, so apply an organisation-wide Tor policy.
Analyst summary
Consistent with engineMalicious: a listed Tor exit node, treated as a malicious traffic source by policy. 100% abuse confidence from 204 reporters, newest today; web app attack, hacking, brute-force. Reported abuse adds to that. The traffic is from anonymous Tor users, not the relay operator.
Why the evidence points to malicious
- [AbuseIPDB] 100% abuse confidence from 204 reporters, newest today; web app attack, hacking, brute-force.
- [GreyNoise] Observed scanning the internet, classified malicious, today.
- [VirusTotal] 15/91 vendors (16.5%) flag it: moderate multi-vendor detection, well short of a majority.
A Tor exit relays many users' traffic; the attacker cannot be identified from this IP.
Attribution
Traffic from a Tor exit belongs to anonymous Tor users; it does not implicate the relay operator.
Written by rules from the engine's evidenceSuggested pivots
Key indicators
- IP address
- 185.220.100.243
- ASN
- AS205100
- Holder
- F3NETZE F3 Netze e.V.
- Country
- Germany (DE)
- Network
- TOR-EXIT
- Prefix
- 185.220.100.0/24
- ISP
- Network for Tor-Exit traffic.
- Usage
- Data Center/Web Hosting/Transit
- Open ports
- 22, 80, 9001, 9200, 10050
- Tor exit
- Yes
- First seen
- Not reported by any source
- Last seen
- 2026-09-30 (0 days before)
By source
RDAPNetwork TOR-EXIT (185.220.100.240 - 185.220.100.255), DE; F3NETZE, F3Netze NOC, F3 Netze e.V..
- Org
- F3NETZE, F3Netze NOC, F3 Netze e.V.
- Range
- 185.220.100.240 - 185.220.100.255
- Country
- DE
- Network
- TOR-EXIT
RIPEstatAnnounced in 185.220.100.0/24 by AS205100 (F3NETZE F3 Netze e.V.).
- ASN
- 205100
- Holder
- F3NETZE F3 Netze e.V.
- Prefix
- 185.220.100.0/24
GreyNoiseObserved scanning the internet, classified malicious, today.
- Name
- unknown
- RIOT
- false
- Noise
- true
- Classification
- malicious
ShodanOpen ports 22, 80, 9001, 9200, 10050.
- Ports
- 22, 80, 9001, 9200, 10050
- Vulns
- 0
- Hostnames
- tor-exit-16.zbau.f3netze.de
Tor exit listListed as an active Tor exit node.
- Exit node
- true
Relationship graph
Click a node for details · edges are observed relationships, not ownershipContext
TOR_EXIT_NODE IP is a currently listed Tor exit node; traffic belongs to many anonymous users.
Attribution
Traffic from a Tor exit belongs to anonymous Tor users; it does not implicate the relay operator.
Relationship ≠ ownership. Shared IPs, ASNs or platforms never imply the same operator.
Threat context
Context onlyNo group is directly linked to this indicator by any source.
ATT&CK techniques reported
Reported targets: Finance, Defense, Industrial, Government, technology, financial-services, United States of America, Turkey, Ukraine, Romania, Czechia, United Kingdom of Great Britain and Northern Ireland, Norway, Lithuania, Estonia, Latvia
Reports mentioning it
- 2026-09-30 Webscanners 2018-02-09 thru current day
- 2026-09-30 Rogue Robot (S3#)
- 2026-09-30 Honeypot Data – T-Pot - Sydney, Australia - August 2026
- 2026-09-30 Honeypot Data – T-Pot - Sydney, Australia - September 2026
- 2026-09-30 Rogue Robot (S3#)
Evidence timeline
- 2026-09-29TorExitList: Listed as an active Tor exit node
- 2026-09-30GreyNoise: Observed scanning the internet, classified malicious, today
- 2026-09-30AbuseIPDB: 100% abuse confidence from 204 reporters, newest today
- 2026-09-30VirusTotal: 15/91 vendors (16.5%) flag it: moderate multi-vendor detection, well short of a majority
- 2026-09-30Investigated
Recommended next steps
- huntSearch firewall, proxy and EDR logs for connections to 185.220.100.243 in the last 30 days.
- pivotPassive DNS: domains that resolved to 185.220.100.243.
- blockBlock or alert on Tor exit traffic under an organisation-wide Tor policy; blocking only this exit is easily bypassed and also blocks legitimate Tor users.
- huntCheck what the traffic from 185.220.100.243 did in our logs: targeted accounts, successful logins, exploit attempts.
Pivot to other tools
Opens the indicator in the source's own site (new tab).