146.190.41.22📋 Copy

# IP Intelligence Briefing: 146.190.41.22/32

## Executive Summary

IP address 146.190.41.22 is classified as Low Risk (Risk Score: 25/100). The endpoint operates as a standard cloud-hosted web server within DigitalOcean's infrastructure with no active malicious indicators detected.

## Technical Profile

• IP Address: 146.190.41.22
• Organization: DigitalOcean, LLC (ASN: 14061)
• Location: Santa Clara, California, United States
• Network Classification: Cloud Compute / Hosting Infrastructure
• Provider Score: 0
• Authority Score: 0

## Network Services & Fingerprinting

• Open Ports: TCP/80 (HTTP), TCP/443 (HTTPS), TCP/22 (SSH)
• Web Server: nginx/1.24.0 (Ubuntu)
• TLS Certificate: Let's Encrypt (CN=liorass.com)
• HTTP Status: 502 (Bad Gateway) observed during fingerprinting
• DNSSEC: Valid

## Threat Assessment

• Abuse Confidence Score: Not applicable
• Blacklist Status: 0 blacklists; 1 DNSBL listing detected
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Associated Campaigns: None identified
• Operator Label: Minimal (0.1304)

## Temporal Analysis

• Observation History: 20 signals recorded (most recent: 2026-06-15)
• Threat Persistence Days: 0
• Ownership Stability: Stable (0 ownership changes)
• Route Stability: Unstable (isRouteStable: false)

## Neighborhood Context

• Subnet: 146.190.41.0/24
• Subnet Classification: Mostly Clean
• Abuse Density: Low
• Active Siblings: 1
• Threat Siblings: 1 (single sibling flagged)
• Total Siblings: 1

## Relationship Graph

The IP maintains 19 relationships, all classified as "Same Network" (DO-13 DigitalOcean network block). No external entity associations detected beyond network-level relationships.

## Recommended Actions

Based on the risk profile, the following actions are recommended:

Accept:

• Web traffic (HTTP/HTTPS) on ports 80/443
• SSH access on port 22 (verify against internal allowlist)

Monitor:

• 502 error responses may indicate application-level issues or backend service failures
• DNSBL listing requires periodic review

No Action Required:

• No immediate blocking recommended
• No firewall rules necessary for defensive posture

## Intelligence Conclusion

This IP represents legitimate cloud infrastructure hosting a web server. The single DNSBL listing and 502 errors warrant routine monitoring but do not indicate active threat activity. The neighborhood shows minimal threat presence with one sibling flagged, suggesting isolated rather than coordinated activity. Maintain standard cloud hosting security posture.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.