THREAT OPS › Threat News › [Tor] 1382 active exit nodes — anonymizing infrastructure (2026-07-14)
[Tor] 1382 active exit nodes — anonymizing infrastructure (2026-07-14)
Tor exit-node snapshot for 2026-07-14. Active exit nodes: 1382 (indexing first 750 as IOCs). Use: flag inbound/outbound connections from anonymizing infrastructure (credential stuffing, scraping, anonymized C2 egress).
MITRE ATT&CK techniques
- Credential StuffingT1110.004
Indicators of compromise
- 171.25.193.25ipv4
- 80.67.167.81ipv4
- 198.98.51.189ipv4
- 89.58.26.216ipv4
- 109.70.100.4ipv4
- 5.45.102.93ipv4
- 192.42.116.99ipv4
- 192.42.116.44ipv4
- 87.118.116.103ipv4
- 192.42.116.12ipv4
- 89.58.41.156ipv4
- 109.70.100.1ipv4
- 179.43.182.232ipv4
- 109.70.100.2ipv4
- 37.187.5.192ipv4
- 109.70.100.8ipv4
- 195.176.3.23ipv4
- 185.165.169.239ipv4
- 109.70.100.6ipv4
- 192.42.116.42ipv4
- 192.42.116.92ipv4
- 192.42.116.14ipv4
- 109.70.100.11ipv4
- 185.35.202.222ipv4
- 109.70.100.7ipv4
- 192.42.116.50ipv4
- 109.70.100.9ipv4
- 192.42.116.43ipv4
- 192.42.116.95ipv4
- 192.42.116.94ipv4
- 190.120.229.98ipv4
- 192.42.116.46ipv4
- 192.42.116.15ipv4
- 87.118.122.51ipv4
- 193.105.134.155ipv4
- 192.42.116.93ipv4
- 171.25.193.79ipv4
- 192.42.116.48ipv4
- 195.176.3.24ipv4
- 192.42.116.51ipv4
Original source: https://metrics.torproject.org/