138.197.157.94📋 Copy

# IP Intelligence Briefing: 138.197.157.94

## Executive Summary

IP address 138.197.157.94 is a DigitalOcean cloud infrastructure server located in Toronto, Ontario, Canada (ASN 14061). Current risk assessment indicates low risk with no active threat indicators. However, historical signal analysis reveals conflicting data points including proxy-type classifications requiring further evaluation.

## Infrastructure Profile

• Organization: DigitalOcean, LLC
• Network Block: 138.197.0.0/16 (CIDR)
• BGP Prefix: 138.197.144.0/20
• Infrastructure Type: Cloud Compute (is_cloud: true, is_hosting: true)
• Country/Region/City: Canada, Ontario, Toronto
• DNS PTR: prod-neon-tor1-2.do.binaryedge.ninja
• Forward Resolution: Confirmed to binaryedge.ninja domain

## Current Threat Assessment

• Risk Score: 0 (Low Risk classification)
• Abuse Confidence Score: Not available
• Blacklist Count: 0
• Known Campaign Associations: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Open Ports/Services: None detected
• TLS Certificate: Not present
• Service Banner: Not detected

DNS Security Posture:

• SPF Record: Present (configured)
• DMARC Record: Not configured
• DNSSEC Validation: Valid

## Historical Signal Analysis

Eighteen observations recorded. Key historical signals include:

1. Proxy Detection Signal (2026-08-06 02:24:26): Classified as "Compromised Server" proxy_type with risk score 66 via proxycheck-io. This signal suggests the IP may have been used for proxy-related activities.

2. Geolocation Signal (2026-08-06 02:25:04): Reported as Canada (CA) with low confidence (0.35) and coordinates (56.13, -106.35) showing significant geolocation uncertainty.

3. DNSBL Signal (2026-08-06 02:24:14): Associated with 8 DNSBL listings but reported listed_count: 0, indicating potential data inconsistency.

## Network Neighborhood

• Subnet: 138.197.157.94/24
• Abuse Density: 0
• Neighbor Count: 0
• Threat Siblings: 0
• Inherited Risk: 0

No adjacent IP addresses show elevated risk profiles.

## Control Plane Analysis

• Origin ASN: 14061
• Route Stability: False
• MOAS Classification: False
• RPKI State: Not available
• IRR Consistency: Not available
• Route Changes (30d): 0

## Relationship Graph

The IP maintains DNS associations with hostname prod-neon-tor1-2.do.binaryedge.ninja (appearing multiple times in relationship data). The hostname prefix suggests potential association with threat intelligence or security operations infrastructure.

## Recommended Actions

Based on current risk profile and historical signals, the following actions are recommended:

1. Monitor: Continue monitoring for changes in threat indicators, particularly given the conflicting proxy detection signals in historical data.

2. Review DNS Configuration: Consider implementing DMARC record for the binaryedge.ninja domain to improve email authentication posture.

3. Contextualize: The hostname "binaryedge.ninja" suggests potential legitimate security operations use. Correlate with threat intelligence platform usage to determine if this is a defensive infrastructure IP.

4. Proxy Classification: Investigate the historical "Compromised Server" proxy classification to determine if this represents legitimate proxy usage for security research or actual malicious activity.

## SOC Analyst Notes

This IP appears to be DigitalOcean cloud infrastructure with a legitimate security operations context (binaryedge.ninja hostname). The low current risk score (0) and no active threat indicators suggest current benign operation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.