128.199.221.212📋 Copy

# IP INTELLIGENCE BRIEFING

Target IP: 128.199.221.212/32

Date: 2026-06-14

Classification: Moderate Risk

---

## EXECUTIVE SUMMARY

IP 128.199.221.212 is a DigitalOcean cloud host located in Singapore operating as a web server. The address carries a moderate risk score of 50, with evidence of DNS blacklist activity and minimal operator reputation. The IP is hosted on cloud infrastructure and resolves to the domain codes.hla-integrated.com. No active threat campaigns or known attacker indicators were identified.

---

## OWNERSHIP & INFRASTRUCTURE

• ASN: 14061 (DigitalOcean)
• Organization: DigitalOcean
• Infrastructure Type: CloudCompute
• CIDR Block: 128.199.192.0/18
• Geolocation: Singapore (SG) — *Note: Geolocation validation flagged as implausible*
• BGP Route Stability: False (route changes observed within 30 days)

---

## NETWORK SERVICES & DNS

Open Ports:

• TCP/443 (HTTPS) — nginx web server
• TCP/22 (SSH) — OpenSSH 8.2p1 Ubuntu

DNS Resolution:

• PTR Hostname: codes.hla-integrated.com
• Domain: hla-integrated.com
• Forward Confirmed: No
• TLS Certificate: Let's Encrypt (R13) issued for codes.hla-integrated.com

Security Posture:

• HSTS Enabled: Yes
• CSP Header: No
• DNSSEC Valid: Yes

---

## THREAT INDICATORS

Control Plane:

• DNSBL Listed: 2 of 8 total lists
• RPKI State: Not Available
• IRR Consistency: Not Available

---

## HISTORICAL OBSERVATIONS

Total Observations: 25 signals collected

• Recent Activity (2026-06-14):

- Cloud infrastructure classification confirmed (DigitalOcean)

- DNS blacklist activity detected with high severity listings

- Operator score assessments completed

• Persistence: No persistent malicious behavior observed

---

## NEIGHBORHOOD ANALYSIS

Subnet: 128.199.221.212/24

• Abuse Density: 1 (elevated)
• Classification: Mostly Clean
• Threat Siblings: 1 identified
• Active Siblings: 1

The subnet shows minimal but present abuse activity, with one related IP flagged as a threat sibling.

---

## RELATIONSHIP GRAPH

• Total Relationships: 58
• Primary Connections: Same Network (DigitalOcean) — 53+ relationships
• Linked Entities: Network-level associations with DigitalOcean infrastructure

---

## RECOMMENDED ACTIONS

Firewall Rules (High Priority)

```bash

# iptables

iptables -A INPUT -s 128.199.221.212 -j DROP

# nftables

nft add rule inet filter input ip saddr 128.199.221.212 drop

```

Web Application Firewall

```nginx

# nginx

deny 128.199.221.212;

# Cloudflare WAF

{"description":"Block 128.199.221.212 — IPDebrief risk score 50", "action":"block", "filter":{"expression":"ip.src eq 128.199.221.212"}}

```

AWS WAF

```json

{"Addresses":["128.199.221.212/32"],"Description":"IPDebrief risk 50"}

```

---

## SOC ANALYST NOTES

1. Block Decision: Recommended due to DNS blacklist activity and moderate risk score

2. Geolocation Warning: Singapore assignment flagged as implausible — verify actual location

3. Domain Investigation: codes.hla-integrated.com warrants additional scrutiny

4. Monitoring: Track for any escalation in abuse density within the /24 subnet

5. False Positive Consideration: Legitimate hosting environment — consider allowing if traffic appears benign

---

Report Generated: IPDebrief Intelligence Platform

Confidence Level: Moderate

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.