Threat LevelHIGH48/1001 rule type

8 incidents on record · confirmed on global blocklist · persistent 8-day campaign · last seen 23d ago

PTR	N/A
Org / ASN	BL Networks
Country	🇷🇴 Romania
City	Bucharest, Bucharest
Timezone	Europe/Bucharest

Attack Analysis

🇷🇴 Romania · Bucharest · 399629 · Bl Networks

IDS: Tor Exit Node

This IP is a known Tor network exit node. Tor anonymizes user traffic by routing it through a series of relays; exit nodes are the final hop where traffic re-enters the public internet. While Tor has legitimate privacy uses, it is heavily abused for anonymous attacks, credential stuffing, and fraud — as the real attacker IP is concealed behind the exit node.

Reports (8)

Date	Severity	Description
9 Jul 2026 - 14:24	high	IDS: Tor exit node — known anonymization network — ET TOR Known Tor Exit Node Traffic group 117
9 Jul 2026 - 14:24	high	IDS: Tor exit node — known anonymization network — ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 117
6 Jul 2026 - 02:31	high	IDS: Tor exit node — known anonymization network — ET TOR Known Tor Exit Node Traffic group 117
6 Jul 2026 - 02:31	high	IDS: Tor exit node — known anonymization network — ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 117
3 Jul 2026 - 16:40	high	IDS: Tor exit node — known anonymization network — ET TOR Known Tor Exit Node Traffic group 117
3 Jul 2026 - 16:40	high	IDS: Tor exit node — known anonymization network — ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 117
1 Jul 2026 - 21:49	high	IDS: Tor exit node — known anonymization network — ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 117
1 Jul 2026 - 21:49	high	IDS: Tor exit node — known anonymization network — ET TOR Known Tor Exit Node Traffic group 117

Report for IP: 72.5.43.62

Attack Analysis

Reports (8)