IPv4 address

185.129.61.2

Last fetched Wed, 07 Oct 2026 19:14:30 GMT

185.129.61.2 is announced in 185.129.61.0/24 by DOTSRC - Forening for DotSrc and geolocates to DK. 185.129.61.2 is listed by 8 threat feeds; reconciled level LOW.

Threat posture

11.63threat score (procedure-native scale)

LOW

Listed by 8 threat feeds.

Categories: Tor

Threat feeds listing this: 8
Verdict coverage: ambiguous
First seen on a feed: Wed, 26 Aug 2026 14:51:22 GMT
Last seen on a feed: Wed, 07 Oct 2026 00:51:41 GMT

Nutrition Label

Attribution

Announced prefix: 185.129.61.0/24
Announcing network: DOTSRC - Forening for DotSrc
RIR-registered prefix: 185.129.60.0/22
RPKI: valid

Abuse contact

Report abuse from 185.129.61.2 to the address block's holder first and copy the announcing network. These are the abuse contacts WhisperGraph holds for the block and the network.

Address block: abuse@zencurity.dk
Network (AS210731): abuse@cert.dk

Network context

185.129.61.2 is a Tor exit address: one Tor relay exits through it.

Signals on the covering block

toxic-neighborhoodShares this address block with a disproportionate share of listed neighbours.
prefix-age-anomalyThis block's registration age is inconsistent with its routing history.

Anycast detection

This does not appear to be an anycast address on the three signals Canon evaluates: reverse DNS, announced-prefix width and the announcing network's peer count.

Reverse DNS

tor-project-exit2.dotsrc.org

Geographic detail

City: Græsted, DK
Country: DK
Dominant city of the prefix: Græsted, DK

Threat-feed listings

blocklist-de-all · blacklists
stamparm-ipsum · blacklists
firehol-level2 · blacklists
firehol-abusers-1d · blacklists
tor-exit-nodes · tor
duggytuxy-datashield-critical · blacklists
stopforumspam-listed-ip-7d · spam
sblam-http-spammers · spam

Threat-feed evidence

History

Pivot from 185.129.61.2 into the prefix, network and country that carry it.

Queries

This address's full card — routing attribution, reverse DNS and listed feeds.


MATCH (ip:IPV4 {name: $ip})
OPTIONAL MATCH (ip)-[:BELONGS_TO]->(rp:REGISTERED_PREFIX)
OPTIONAL MATCH (ip)-[:ANNOUNCED_BY]->(ap:ANNOUNCED_PREFIX)
OPTIONAL MATCH (a:ASN)-[:ROUTES]->(ap)
OPTIONAL MATCH (a)-[:HAS_NAME]->(an:ASN_NAME)
OPTIONAL MATCH (ip)-[:LOCATED_IN]->(city:CITY)
OPTIONAL MATCH (ip)-[:HAS_COUNTRY]->(ipc:COUNTRY)
WITH ip, rp, ap, a, an, city, ipc
LIMIT 10
WITH ip,
     collect(rp.name) AS registeredPrefixes,
     collect(rp.abuseEmail) AS registeredAbuseEmails,
     collect({prefix: ap.name, asn: a.name, network: an.name, isMoas: ap.isMoas, rpkiStatus: ap.rpkiStatus, isAnycast: ap.isAnycast, dominantCity: ap.dominantCity, abuseEmail: ap.abuseEmail, networkAbuseEmail: a.abuseEmail}) AS announcements,
     collect(city.name) AS cities,
     collect(ipc.name) AS countries,
     collect(a.name) AS announcerNames,
     head(collect(a)) AS primaryAsn,
     head(collect(ap)) AS primaryPrefix
OPTIONAL MATCH (primaryPrefix)-[:CONFLICTS_WITH]->(conflict:ASN)
WITH ip, registeredPrefixes, registeredAbuseEmails, announcements, cities, countries, announcerNames, primaryAsn,
     collect(conflict.name) AS conflictAsns
CALL { WITH primaryAsn MATCH (primaryAsn)-[:ROUTES]->(p:ANNOUNCED_PREFIX) RETURN count(p) AS asnPrefixCount }
CALL { WITH primaryAsn MATCH (primaryAsn)-[:BGP_NEIGHBOR]-(peer:ASN) RETURN count(peer) AS asnPeerCount }
RETURN ip.name AS name,
       ip.verdictLevel AS verdictLevel,
       ip.verdictScore AS verdictScore,
       ip.verdictBlocking AS verdictBlocking,
       ip.verdictCoverage AS verdictCoverage,
       ip.verdictAdvisory AS verdictAdvisory,
       ip.threatSources AS threatSources,
       ip.threatFirstSeen AS threatFirstSeen,
       ip.threatLastSeen AS threatLastSeen,
       ip.isTor AS isTor,
       ip.isVpn AS isVpn,
       ip.isProxy AS isProxy,
       ip.isC2 AS isC2,
       ip.isPhishing AS isPhishing,
       registeredPrefixes, registeredAbuseEmails, announcements, cities, countries, announcerNames, conflictAsns,
       asnPrefixCount, asnPeerCount

Run yourself →

Network context — Tor exit relays, attributed actors, and the covering blocks' signals, cloud region and vendor.


MATCH (ip:IPV4 {name: $ip})
OPTIONAL MATCH (ip)-[:OPERATES_EXIT_NODE]->(tor:TOR_RELAY)
WITH ip, count(tor) AS torRelays
OPTIONAL MATCH (ip)-[:ATTRIBUTED_TO]->(actor:ACTOR)
WITH ip, torRelays, collect(actor.name)[0..5] AS actors
OPTIONAL MATCH (ip)-[:BELONGS_TO]->(p:PREFIX)
WITH torRelays, actors, collect(p.name) AS coveringPrefixes
UNWIND (CASE WHEN size(coveringPrefixes) = 0 THEN [null] ELSE coveringPrefixes END) AS pn
OPTIONAL MATCH (cp:PREFIX {name: pn})
OPTIONAL MATCH (cp)-[:HAS_SIGNAL]->(sig:THREAT_SIGNAL_TYPE)
OPTIONAL MATCH (cp)-[:PREFIX_IN_REGION]->(reg:CLOUD_REGION)
OPTIONAL MATCH (cp)-[:DELEGATED_TO]->(v:VENDOR)
RETURN torRelays, actors,
       collect(sig.name) AS signals,
       collect(reg.name) AS regions,
       collect(v.name) AS vendors