159.223.196.179
IP Intelligence Briefing: 159.223.196.179
Date: 2026-06-13
---
**1. Core Profile**
- Risk Rating: Moderate Risk (Risk Score: 50)
- Provider: DigitalOcean (AS14061)
- Geolocation: Santa Clara, CA, US (Geo-Plausibility: False)
- Network Role: Cloud Hosting (DigitalOcean Infrastructure)
- Services:
- HTTP/HTTPS (Ports 80/443)
- SSH (Port 22)
- HTTP-alt (Port 8080)
- TLS Certificate: Issued to `labaidprism.com` (Let’s Encrypt)
- Threat Indicators:
- No direct malicious activity detected.
- Listed on 2 DNSBLs (out of 8 total lists).
- High RTT anomaly (84ms vs. expected 177ms for 8858km distance).
---
**2. Observation History**
- Recent Activity (Last 30 Days):
- High-risk signals: Listed on 8 threat feeds (2 high-severity, 5 medium).
- Cloud Hosting: Confirmed as DigitalOcean cloud instance (SSH banner, BGP prefix).
- Web Server: HTTP/HTTPS services with nginx server banner.
- DNSSEC: Validated, but no CAA records.
- Geo Validation: RTT discrepancy suggests potential spoofing or misconfigured routing.
---
**3. Network Relationships**
- Linked Entities:
- Subnet: `159.223.192.0/20` (DigitalOcean)
- Related IPs: 2 active siblings in the `/24` subnet.
- Neighbor Analysis:
- 159.223.196.243: Low risk (Score: 30), no abuse indicators.
- Subnet abuse density: 0% (mostly clean).
---
**4. Threat Context**
- No Known Campaigns: No correlated malicious activity or known attacker IPs.
- DNSBL Listings: 2 out of 8 lists (likely false positives given low-risk neighbors).
- SSL/TLS: Valid certificate, but no HSTS or CSP restrictions observed.
---
**5. SOC Recommendations**
1. Monitor Traffic: Track unusual outbound connections or changes in service behavior.
2. Verify Geo-Location: Investigate RTT anomalies to rule out spoofing or routing issues.
3. Check DNSSEC: Ensure DNS records are properly configured to prevent spoofing.
4. Validate Certificate: Confirm `labaidprism.com` is legitimate and not a phishing target.
5. Network Segmentation: Isolate cloud-hosted services to limit lateral movement risks.
---
Conclusion: This IP is a DigitalOcean cloud instance hosting a website with no direct malicious activity. While it shows some DNSBL listings, the subnet is otherwise clean. The RTT anomaly warrants further investigation.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | DigitalOcean, LLC |
| ASN | AS14061 |
| Network Name | — |
| CIDR Block | — |
| RIR | ARIN |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Present |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Web Server |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| 22 | ssh | tcp | |
| 8080 | http-alt | tcp | — |
| Closed Ports | 25, 3389, 8443 (4 open / 7 scanned) | ||
| Server | nginx |
| HTTP Title | — |
| SSH Version | SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.16 |
🔐 TLS Certificate
CN=labaidprism.com was found on this IP. This may indicate a previously hosted website, a decommissioned service, or stale infrastructure.| SANs | labaidprism.comwww.labaidprism.com |
| Valid From | 2026-03-06T23:22:34+00:00 |
| Valid Until | 2026-06-04T23:22:33+00:00 (expired) |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_256_GCM_SHA384 |
| Signature Algorithm | sha384ECDSA |
| Validity Period | 89 days |
| Serial Number | 05562236A14AC9FC29DE7A824DDCEB4879CF |
| Thumbprint | 1FA5557174539C83E3FF7CFA1BA0A779665B645D |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 28% | 2 | 4 |
| routing | 8% | 1 | 1 |
| services | 25% | 2 | 3 |
| ownership | 20% | 2 | 3 |
| reputation | 28% | 1 | 3 |
| geolocation | 27% | 2 | 3 |
| Overall | 23% | 10 | 17 |
| Data Coherence | Mixed Signals (65%) — 2 contradiction(s) |
| Attribution | Low (35%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
⚠ High authority score (70) but appears on threat lists (risk 50)
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-07 23:03:49 UTC |
| Last Seen | 2026-06-27 00:56:37 UTC |
| Profile Built | 2026-06-27 15:10:13 UTC |
| Data Freshness | Live |
| Signal Types | 23 |
| Total Observations | 27 |
Full dossier details are available via our API.