159.203.108.2📋 Copy

IP Intelligence Briefing: 159.203.108.2

Date: 2026-06-10

1. Core Profile

• Risk Assessment: Low risk (riskScore: 25/100). No malicious indicators, abuse confidence, or blacklist entries.
• Ownership: Owned by DigitalOcean, LLC (ASN 14061).
• Geolocation: Located in Clifton, NJ, US (geoplacement inferred via IP).
• Network Role: Cloud compute instance (DigitalOcean infrastructure). Hosts HTTP/SSH services.

2. Threat Observations

• No malicious activity detected: No indicators of phishing, malware, or exploit campaigns.
• Services:

- Open ports: HTTP (80/tcp) and SSH (22/tcp).

- SSH banner: `SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2`.

- HTTP server: `openresty/1.9.3.1`.

• TLS: No active TLS certificate observed.

3. Network Relationships

• Subnet: Part of 159.203.0.0/20 (DigitalOcean ASN 14061).
• Neighbors: No adjacent IPs found in the /24 subnet (159.203.108.0/24).
• Subnet Abuse: Clean subnet (abuseDensity: 0).

4. Temporal Trends

• Stability: IP has remained consistent as a cloud-hosted service since at least June 2026.
• No recent changes: No observed shifts in network role, geolocation, or threat signals.

5. Security Recommendations

• Monitor SSH access: Ensure SSH keys are restricted to authorized users, given the exposure of versioned banners.
• Verify HTTP service: Confirm the openresty server is configured securely, as no TLS certificate was detected.
• Subnet monitoring: Track 159.203.108.0/24 for unexpected activity, though current data shows no abuse.

Conclusion:

This IP is a legitimate DigitalOcean cloud instance with no signs of malicious activity. Its low risk profile and stable network role suggest it is a standard hosting environment. No immediate action is required, but ongoing monitoring is advised for anomalous behavior.

Source: IPDebrief Threat Intelligence Platform.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.