159.223.101.229📋 Copy

# IP Intelligence Briefing: 159.223.101.229/32

Classification: LOW RISK / CLOUD INFRASTRUCTURE

Date: 2026-08-05

Analyst: SOC Intelligence Team

---

## Executive Summary

IP address 159.223.101.229 is a DigitalOcean cloud host classified as low-risk (risk score: 25). The IP resolves to a hostname associated with BinaryEdge intelligence infrastructure (prod-astatine-nyc1-10.do.binaryedge.ninja) and demonstrates consistent "mostly_clean" classification across observation history. No active threat indicators or malicious campaign associations were detected.

---

## Ownership & Network Data

The IP is registered to DigitalOcean's DO-13 network block. The subnet exhibits abuse density of 1 with inherited risk classification of 2. No threat siblings were identified within the /24 neighborhood.

---

## Threat Assessment

Risk Profile

• Overall Risk Score: 25 (Low)
• Abuse Confidence Score: Not applicable (clean classification)
• Blacklist Status: Not listed
• Known Attacker: No
• Spam Source: No
• Tor Exit: No

Network Classification

• Infrastructure Type: Cloud Host
• Connection Type: Single-Service Host
• Services Detected: SSH (port 22/TCP, OpenSSH_8.9p1 Ubuntu)

Threat Indicators

• DNSBL Listed: 1 of 8 checks
• Operator Score: 0.2609 (Basic)
• Campaign Likelihood: None
• Threat Persistence Days: 0

---

## DNS & Hostname Analysis

The IP resolves via forward confirmation to:

• Primary Hostname: prod-astatine-nyc1-10.do.binaryedge.ninja
• Domain: binaryedge.ninja
• Email Authentication: SPF configured, DMARC not configured

DNSSEC validation is confirmed. The hostname pattern and "binaryedge" domain reference indicate association with BinaryEdge, a threat intelligence data platform. The "astatine" component suggests this may be part of a dedicated threat intelligence infrastructure deployment.

---

## Geolocation Validation

Geolocation data shows inconsistencies requiring analyst review:

• Claimed Location: New Jersey, US (40.7964° N, -74.0203° W)
• Geolocation Plausibility: False
• RTT Violation: Observed 19.0ms < minimum possible 119.3ms for 5,963 km distance
• Probe Count: 5 probes

The RTT violation suggests either misreported geolocation data or the IP is being hosted in an unexpected location. This is a common characteristic of cloud infrastructure where physical location may not match registered data.

---

## Historical Observations (2026-07-30 to 2026-08-05)

Signal history shows consistent classification:

• Subnet Classification: "mostly_clean" across all observations
• Abuse Density: Stable at 1
• Threat Observation Count: 1
• Ownership Changes: None detected

No escalation in risk profile observed over the observation period. The IP has not exhibited persistent malicious behavior.

---

## Recommendations

Based on current risk profile (25/100), no immediate blocking or mitigation actions are recommended. The IP is associated with legitimate threat intelligence infrastructure.

Suggested Actions:

• No firewall rules required for this IP
• Monitor for any changes in DNS resolution patterns
• Consider geo-location validation updates if location accuracy is critical

---

Status: Monitor / No Action Required

Confidence Level: High (consistent historical data)

*End of Briefing*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.