143.198.221.127📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 143.198.221.127/32

Classification: Low Risk Infrastructure IP

Date: 2026-06-21

---

## EXECUTIVE SUMMARY

IP 143.198.221.127 is a DigitalOcean cloud infrastructure asset located in Singapore (Pioneer) with a risk score of 25 (Low Risk). The IP demonstrates minimal threat activity, operates as a web server, and maintains a stable operational profile with no persistent malicious indicators.

---

## OWNERSHIP & INFRASTRUCTURE

---

## NETWORK SERVICES & FINGERPRINT

• Open Ports: 22 (SSH), 80 (HTTP), 443 (HTTPS)
• Web Server: Caddy (reverse proxy)
• SSH Version: OpenSSH_9.6p1 Ubuntu-3ubuntu13.16
• DNS Resolution: No PTR hostnames; forward resolution: 0 records
• Email Authentication: SPF/DMARC not configured

---

## THREAT INDICATORS

• Risk Score: 25 (Low)
• Provider Score: 0
• Authority Score: 0
• Abuse Confidence Score: N/A
• Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• DNSBL Listings: 1 of 8 total lists
• Threat Observation Count: 1
• Persistent Malicious Activity: No

---

## TEMPORAL ANALYSIS

• Observation Period: 2026-06-16 to 2026-06-21
• Threat Persistence: 0 days
• Ownership Changes: 0
• Recent Activity:

- 2026-06-16: Port scan detected; Caddy banner observed; subnet classified as "mostly_clean"

- 2026-06-19: HTTPS connection failure recorded

- 2026-06-21: Operator score 0.15 (Minimal); DNSSEC validation present

---

## SUBNET NEIGHBORHOOD

• Subnet: 143.198.221.127/24
• Abuse Density: 0
• Classification: Mostly Clean
• Active Siblings: 1
• Threat Siblings: 2
• Neighbor Risk Profile: Single neighbor (143.198.221.188) with risk score 25

---

## SECURITY ASSESSMENT

The target IP represents a benign cloud infrastructure resource. Key observations:

1. Low Threat Posture: Risk score of 25 indicates minimal concern. No active threat indicators or persistent malicious behavior detected.

2. Standard Cloud Profile: DigitalOcean hosting with expected web server configuration (Caddy) and SSH access.

3. Stable Operations: No ownership changes; minimal operator score (0.1304); DNSSEC valid.

4. Subnet Context: The /24 subnet shows low abuse density (0) with mostly clean classification, though 2 threat siblings exist.

---

## RECOMMENDED ACTIONS

• Firewall Rules: No blocking required. Standard allow policies apply.
• Monitoring: Routine monitoring sufficient. No escalation needed.
• Network Segmentation: Treat as legitimate cloud infrastructure.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.