142.93.120.48📋 Copy

IP INTELLIGENCE BRIEFING: 142.93.120.48/32

Assessment: LOW RISK – Cloud Infrastructure Endpoint

Overview

IP address 142.93.120.48 is a DigitalOcean cloud compute endpoint (ASN 14061) located in the United States. Overall risk assessment is Low Risk with a risk score of 25. The IP operates within a cloud hosting infrastructure with no open ports or active services detected.

Ownership and Classification

• Owner: DigitalOcean, LLC
• Network: 142.93.112.0/20 (BGP prefix)
• Location: North Bergen, NJ, US
• Infrastructure Type: Cloud Compute
• Classification: Hosted environment, not CDN/proxy/Tor

Threat Indicators

• Abuse Confidence: Not flagged as known attacker, spam source, or Tor exit node
• Blacklist Status: Listed on 1 of 8 DNSBL feeds
• Known Campaigns: None identified
• Malware/Honeypot Activity: No evidence of honeypot hits or enumeration strikes

Subnet Context (142.93.120.0/24)

• Abuse Density: 0.3333 (low-to-moderate)
• Threat Siblings: 1 out of 3 active IPs in subnet
• Neighbor IPs:

- 142.93.120.95 (Risk Score: 25)

- 142.93.120.132 (Risk Score: 25)

• Overall Subnet Classification: Mostly clean

Historical Observations

• Total Observations: 22 signals recorded
• Threat Persistence: Not persistently malicious
• Recent Activity: Observations from June 2026 show stable subnet abuse metrics
• Geo Validation: ICMP probe validation unsuccessful (blocked); geo data inferred via multi-signal methods

Technical Capabilities

• DNS Resolution: No PTR records; forward resolution not confirmed
• TLS/Services: No open ports detected; no TLS certificates or HTTP banners observed
• Control Plane: DNSSEC valid; CAA records present; operator score minimal (0.2174)

Recommended Actions

• Monitor as standard cloud infrastructure traffic
• No immediate blocking required given low-risk profile
• Consider correlation with 2 neighboring IPs (142.93.120.95, 142.93.120.132) for subnet-level context
• DNSBL listing warrants periodic review but does not indicate active threat

Conclusion

This IP represents legitimate cloud infrastructure with minimal threat indicators. The single DNSBL listing and neighborhood abuse density suggest standard hosting environment activity. SOC teams may treat inbound connections as low-risk but maintain awareness of the subnet's 1 threat sibling for contextual correlation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.