Forensia: Free Threat Intelligence Lookup

FORENSIA

Indicator investigation

warming up…

Resolving indicator evidenceacquiring

Loading verdict, provenance, relationships and sightings.

Opening Forensia workspaceacquiring

Loading the current evidence view. Navigation and account controls remain available.

Loading recent evidenceacquiring

Verdict

MENTIONED — 1 report, unverified

What is this: IP observed in Tor Exit Nodes. This is a Tor exit node — traffic leaving it is anonymised.
Should you care: Reports against a Tor exit attribute to the exit, not to the person behind it — thousands of unrelated users share this address. Weak signal — mentioned in 1 report, not corroborated across feeds.
What to do: No action — weak signal.

INCOMPLETEMODERATE EVIDENCE COVERAGEDeterministic · stored evidence only

Infrastructure investigation

Complete infrastructure checks before concluding

Forensia has a warehouse observation, but exposure or network evidence is incomplete. Missing providers must not be interpreted as an all-clear.

Infrastructure role

Tor exit infrastructure

Role derived only from stored classifications and tags.

Network owner

Unattributed network

United States of America

Internet exposure

0 ports · 0 products

Not checked by an exposure provider.

Known CVE associations

Shodan did not complete.

Corpus evidence

1 connectors · 944 citations

14 related infrastructure pivots by shared non-noise tags.

Observation window

2026-07-20 → 2026-09-05

First and last appearance in the local corpus, not global activity dates.

What the evidence supports

Findings stay bounded to named sources and observable infrastructure.

1 finding

14 related infrastructure pivots

MODERATE

Related indicators share specific non-noise tags such as malware family, campaign marker, or infrastructure role.

Deterministic shared-tag comparison

Shared tags support investigation pivots, not common ownership or campaign attribution.

What remains unknown

No exposure provider completed, so open services and CVE associations are unknown.
The current network owner or autonomous system is not established in available metadata.
No completed reputation enrichment is available; provider silence is not an all-clear.
IP addresses can be reassigned or shared, so historical malicious use may not describe the current operator.

What this is

IP indicator: 23.191.200.31

related indicators · 14

Graph preview

Neighborhood topology. Open the graph for interactive pivots.

Open full investigation canvas →

Building relationship previewacquiring

Loading connected indicators, reports and entities.

Continue investigation

High-signal pivots without leaving the thread you started in search.

Related alerts, reports, and entities
Structured pivots from local graph context.
Open in graph
Full investigation canvas with neighbor expansion.