107.170.70.18📋 Copy

IP INTELLIGENCE BRIEFING: 107.170.70.18

Classification: Low Risk Cloud Infrastructure | Date: Analysis Complete

Infrastructure Profile

Target 107.170.70.18 is a DigitalOcean cloud host (ASN 14061) registered in New York, NY. The IP operates within a /17 BGP prefix (107.170.0.0/17) with origin AS14061. Risk scoring indicates low threat exposure (score: 25/100). The endpoint functions as a multi-service host with standard web and SSH services.

Network Services & Fingerprinting

• HTTP (Port 80/TCP): Apache/2.2.22 on Ubuntu server
• SSH (Port 22/TCP): OpenSSH_5.9p1 Debian-5ubuntu1.1
• HTTP response code: 302 (redirect)
• HTTP version: 1.1
• Response time: 54ms TTFF

Threat Indicators

No active threat indicators detected. The IP is not classified as a known attacker, spam source, or Tor exit node. Zero blacklist entries confirmed. DNSBL monitoring shows presence on 1 of 8 evaluated lists. Control plane operator score: 0.1304 (Minimal risk).

Geolocation Validation

Geolocation data indicates New York, US with 2500km accuracy radius. However, RTT validation reveals a discrepancy: claimed distance 5966km with observed RTT 19ms, which violates minimum possible RTT of 119.3ms for this distance. This suggests potential location spoofing or inaccurate geolocation data.

Historical Analysis

Observation history contains 21 signal observations. Recent fingerprinting (2026-06-20) confirmed Apache web server configuration. Subnet-level abuse density classification: "mostly_clean" with 1 threat sibling in the /24 neighborhood. No persistent malicious activity detected; threat persistence days: 0.

Network Context

The target IP resides within DigitalOcean's 107.170.0.0/24 subnet. Neighborhood analysis shows abuse density of 0, with no high or medium risk neighbors identified. All relationships map to the same network block (DIGITALOCEAN-107-170-0-0). No hostname, certificate, or organizational relationships detected.

Recommended Actions

No immediate firewall blocking or mitigation rules recommended based on current risk profile. Standard monitoring and logging advised. The geolocation RTT anomaly warrants continued observation to determine if this indicates malicious activity or simply inaccurate geolocation data.

Assessment

This IP represents routine cloud infrastructure hosting with minimal threat indicators. The low risk score and absence of malicious indicators support continued traffic permitting. Monitor for changes in threat posture, particularly given the geolocation validation discrepancy.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.