143.110.181.226📋 Copy

# IP Intelligence Briefing: 143.110.181.226

## Executive Summary

IP 143.110.181.226 presents a moderate risk profile (score: 65/100) associated with DigitalOcean cloud infrastructure. The IP demonstrates proxy/VPN behavior in recent observations and shows geographic inconsistencies between reported locations. No active threat indicators or known campaign associations detected. Recommended action: implement logging monitoring and consider blocking based on organizational policy.

## Ownership and Infrastructure

• ASN: AS14061 (DigitalOcean, LLC)
• Network Block: 143.110.128.0/17 (DIGITALOCEAN-143-110-128-0)
• Infrastructure Type: Cloud compute provider
• Geolocation: Bengaluru, Karnataka, India (multiple sources report India; one source reported US)
• Service Status: No open ports detected; classification indicates "Firewalled / No Services"

## Risk Assessment

## Threat Indicators

• Proxy/VPN Detection: Confirmed in recent observations (proxy_type: VPN)
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0 (but DNSBL listed on 3 of 8 reputation lists)
• Threat Campaigns: None detected
• Known Attacks: No active indicators

## Neighborhood Analysis

• Subnet: 143.110.181.226/24
• Abuse Density: 0.0 (clean classification)
• Neighbor IP: 143.110.181.178 (risk score: 50/100)
• Threat Siblings: 0
• Active Siblings: 0

## Behavioral History

Analysis of 19 observations reveals:

• Recent activity concentrated on 2026-06-22 with proxy/VPN classification
• Risk scores ranged from 65-66 in recent observations
• Geographic data shows inconsistency (India vs US reports)
• No persistent malicious behavior detected
• Route stability shows recent changes (not stable for 30 days)

## Network Classification

• ISP: DigitalOcean
• Connection Type: Cloud infrastructure
• Mobile Carrier: N/A
• Proxy: Yes (recently detected)
• Hosting: Yes
• Tor/VPN: Proxy behavior confirmed

## Recommended Actions

Immediate

1. Increase logging verbosity for traffic from this IP

2. Review recent activity from 143.110.181.226 in SIEM/SOC tools

Firewall Rules

```bash

# iptables

iptables -A INPUT -s 143.110.181.226 -j DROP

# nftables

nft add rule inet filter input ip saddr 143.110.181.226 drop

# nginx

deny 143.110.181.226;

# pfSense

143.110.181.226/32

# Cloudflare WAF

ip.src eq 143.110.181.226 (action: block)

# AWS WAF

Addresses: 143.110.181.226/32

```

## Analyst Notes

The IP's proxy/VPN detection combined with DNSBL listings suggests potential misuse of cloud infrastructure for anonymization. Geographic inconsistencies between sources warrant monitoring. While no active attack indicators are present, the moderate risk score and proxy behavior justify enhanced logging and consideration of blocking based on threat level and organizational policy.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.