139.59.104.232📋 Copy

# IP Intelligence Briefing: 139.59.104.232

## Executive Summary

IP address 139.59.104.232/32 is a DigitalOcean cloud infrastructure host located in Singapore (SG). The asset presents a low-risk profile with a risk score of 25 and no persistent malicious activity. While the IP appears in one DNS blacklist, the overall neighborhood classification is "mostly_clean" with no threat siblings detected within the /24 subnet.

## Ownership & Infrastructure

• Provider: Digital Ocean Inc. administrator (ASN 14061, DIGITALOCEAN-AP)
• Network Block: 139.59.96.0/20
• Infrastructure Type: Cloud Compute / Web Server
• Location: Singapore (1.35, 103.82), timezone Asia/Singapore
• Geolocation Validation: Consensus confirmed with 2 sources

## Network Services & TLS Configuration

• Open Ports: TCP/80 (HTTP), TCP/443 (HTTPS), TCP/22 (SSH - OpenSSH 9.6p1 Ubuntu)
• TLS Certificate: Issued by Let's Encrypt for crm.fadakmarine.com (CN=crm.fadakmarine.com)
• Server Banner: nginx/1.24.0 (Ubuntu)
• HTTP Status: 302 (Redirect)
• DNSSEC: Valid

## Threat Indicators

• Risk Score: 25 (Low Risk)
• Abuse Confidence Score: Not applicable
• Blacklist Status: Listed on 1 of 8 DNSBLs
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Activity: None detected

## Control Plane & Routing

• Origin ASN: 14061
• BGP Prefix: 139.59.96.0/20
• Route Stability: Unstable
• Operator Score: 0.1304 (Minimal)
• DNSBL Listed Count: 1

## Neighborhood Analysis

• Subnet: 139.59.104.232/24
• Abuse Density: 0
• Threat Siblings: 1
• Classification: Mostly clean
• Risk Distribution: No high or medium risk neighbors

## Historical Observations

• Total Observations: 21
• Recent Activity: Observed on 2026-06-21
• Threat Persistence: 0 days
• Ownership Changes: 0
• Status: Not persistently malicious

## Relationships

The IP has 20 recorded relationships, all identifying as "Same Network" connections to DIGITALOCEAN-AP, confirming its placement within the DigitalOcean Asia-Pacific network infrastructure.

## Recommended Actions

Based on the low-risk profile and lack of persistent malicious indicators, the IP does not require immediate blocking. Standard monitoring practices apply. The single DNSBL listing may warrant investigation if it correlates with observed malicious activity patterns.

---

*Generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.