IP Report
188.68.36.28
netcup GmbH · AS197540 · Karlsruhe (Nordweststadt), Germany
Score 85 of 100, in the high risk band. Bands run 0 to 19 minimal, 20 to 49 low, 50 to 79 medium, 80 to 100 high.
Its risk score of 85/100 is high: multiple strong signals stack up here, and most sites that screen traffic would challenge or block requests from this address.
Detection signals
Not detected: VPN, Proxy, Crawler
Summary
188.68.36.28 is a Tor exit node — traffic leaving the Tor anonymity network reaches the open internet from this address, which means the person or program behind a request cannot be identified from the IP alone.
The address is announced by netcup GmbH (AS197540) and geolocates to Karlsruhe (Nordweststadt), Baden-Wurttemberg, Germany.
Why this address scores 85
It is a listed Tor exit node — the strongest single signal we score, because Tor exits are shared by everyone using the network, including its worst actors.
It sits in datacenter address space, where automated traffic vastly outnumbers human visitors.
Together these produce the score of 85/100 shown above.
Observation history
This address has been looked up through Predax once, on August 31, 2026.
Network & location
- ASN
- AS197540
- Country
- Germany (DE)
- Provider
- netcup GmbH
- Region
- Baden-Wurttemberg
- CIDR
- 188.68.32.0/19
- City
- Karlsruhe (Nordweststadt)
- Network type
- hosting
- First seen
- 8/31/2026, 3:09:58 PM
- Last seen
- 8/31/2026, 3:09:58 PM
- Times seen
- 1
What to do with this
If you run a site and this address showed up
Tor exits carry both abuse and legitimate privacy-conscious visitors, and you cannot tell which from the address alone.
Blocking this address at checkout, login, or signup is a defensible default. For ordinary content pages, a challenge (CAPTCHA) keeps the privacy-conscious readers you may want while stopping automation.
Tor exit lists change daily, so this is a policy to automate rather than maintain by hand — the Predax Security plugin for WordPress and the WooCommerce version both screen Tor exits against live data on every visit.
If you found this address in your logs
A request from this address tells you nothing reliable about the client’s location or identity — that is what Tor is for.
Per-IP rate limits and geo checks are unreliable here: every Tor user sharing this exit looks identical. Key abuse decisions on the account or session instead of the IP.
Loading map...
Detection sources
- DatacenterVerified · 95%
Listed in a published datacenter range feed. Hosted in a cloud / datacenter range. Typical of automation, scrapers, and bots — not consumer browsers.
- TorVerified · 99%
Active Tor exit node. Tor exit node. Anonymous traffic used by privacy advocates and adversaries alike.