Forensia CTI Core

Verdict

MENTIONED — 2 reports, unverified

What is this: IP observed in Tor Exit Nodes. Hosted on AS400226 StormyCloud Inc. This is a Tor exit node — traffic leaving it is anonymised.
Should you care: Reports against a Tor exit attribute to the exit, not to the person behind it — thousands of unrelated users share this address. Weak signal — mentioned in 2 reports, not corroborated across feeds.
What to do: No action — weak signal.

What this is

IP indicator: 23.128.248.163

Exposure

Open ports, software & known CVEs · via Shodan InternetDB + Censys

STORMYCLOUDINC - StormyCloud Inc · canonical linux

Open ports (5)

80 HTTP443 HTTPS474790019030

Software

openssh

Services · via Censys

HTTPSSH

tor-exit-004.stormycloud.org · tor

Threat detail

Exploitation status and malware-family attribution from stored fields.

exploitation: unknown

Graph preview

Neighborhood topology — open the graph for interactive pivots.

Loading graph…

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

Related alerts, reports, and entities
Structured pivots from local graph context.
Open intel graph (neighborhood)
See edges, pivots, and corroboration at a glance.
Investigation canvas
Full inspector with neighbor expansion.