157.245.125.199📋 Copy

## IP Intelligence Briefing: 157.245.125.199/32

Classification: Low Risk – Cloud Infrastructure Web Server

Report Date: 2026-06-21

---

Executive Summary

IP address 157.245.125.199 is a DigitalOcean cloud-hosted web server with an overall risk score of 25 (Low Risk). The IP exhibits no active threat indicators and maintains a "mostly_clean" classification within its /24 subnet. While geolocation data shows inconsistencies and the subnet contains two threat-adjacent neighbors, the IP itself shows no persistent malicious behavior. No immediate defensive action required.

---

Technical Profile

Ownership & Infrastructure

• Organization: DigitalOcean, LLC
• ASN: 14061
• Network Block: 157.245.0.0/16 (DIGITALOCEAN-157-245-0-0)
• Infrastructure Type: Cloud Compute (Cloud hosting provider)
• Service Purpose: Web Server

Network Services

• Open Ports: 80/tcp (HTTP), 443/tcp (HTTPS)
• Web Server: nginx/1.14.0 (Ubuntu) + Phusion Passenger 6.0.18
• TLS Certificate: Let's Encrypt (R12)
• Certificate Subject: CN=production.unitingurantia.org
• SANs: production.unitingurantia.org, staging.unitingurantia.org
• Email Authentication: SPF and DMARC records present

---

Threat Assessment

Risk Metrics

• Overall Risk Score: 25 (Low)
• Provider Score: 0
• Authority Score: 0
• Abuse Confidence Score: Not applicable
• Blacklist Count: 0
• DNSBL Listed: 1 listing across 8 total lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

Control Plane Analysis

• BGP Prefix: 157.245.112.0/20
• Route Stability: False
• RPKI State: Unverified
• Operator Score: 0.1304 (Minimal)

---

Neighborhood Context

Subnet: 157.245.125.0/24

• Abuse Density: 1
• Classification: Mostly Clean
• Total Siblings: 2
• Active Siblings: 2
• Threat Siblings: 2

Notable Neighbor:

• 157.245.125.104 – Risk Score: 25, Authority Score: 50

---

Observation History

• Total Observations: 22
• Timeframe: Most recent activity observed 2026-06-21
• Threat Persistence Days: 0
• Classification Trend: Consistently "mostly_clean"
• Persistent Malicious Activity: None detected

---

Anomalies & Concerns

1. Geolocation Inconsistency: geoPlausible flag is false. Probe data indicates RTT of 25.0ms, which is significantly below the minimum possible 119.4ms for a 5,968km distance, suggesting unreliable geolocation reporting.

2. Route Stability: BGP routing shows instability (isRouteStable: false), which may indicate transient traffic patterns or infrastructure changes.

3. DNSBL Presence: 1 DNSBL listing detected across 8 total lists. Further investigation of blacklist specifics may be warranted.

---

Recommended Actions

Current Risk Level: LOW

• No firewall rules recommended for immediate blocking
• No specific security actions generated

Monitoring Recommendations:

• Monitor for changes in DNSBL listing status
• Track neighborhood risk levels in 157.245.125.0/24 subnet
• Review BGP prefix stability if routing anomalies observed
• Periodic re-evaluation recommended if threat context changes

For SOC Analysts:

This IP represents legitimate cloud infrastructure with low observed risk. No immediate incident response or blocking required. If this IP appears in incident logs, investigate context (legitimate traffic vs. compromised host). The domain production.unitingurantia.org should be verified as expected legitimate traffic.

---

Related Entities

• Network: DIGITALOCEAN-157-245-0-0 (21 network relationship records)
• Related IP: 157.245.125.104 (same /2

0/24 subnet)

• Organization: DigitalOcean, LLC (14061)

---

Final Assessment

The IP address 157.245.125.199 represents a standard cloud web hosting environment with minimal observed threat activity. The risk profile is consistent with legitimate DigitalOcean infrastructure. The primary concern remains the geolocation data inconsistency and the presence of threat-adjacent neighbors in the immediate /24 subnet, neither of which indicate direct compromise of this specific IP.

Threat Level: LOW

Action Required: None

Review Interval: Periodic monitoring recommended if traffic anomalies emerge

---

End of Intelligence Briefing

Generated by IPDebrief

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.