# 159.223.97.218 — IP Intelligence Summary

159.223.97.218 is an IPv4 address operated by DigitalOcean, LLC (AS14061), geolocated to North Bergen, United States. It belongs to datacenter or hosting infrastructure. As of November 2, 2026, IPDebrief rates it Moderate Risk (65/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/159.223.97.218
- Last updated: 2026-11-02

## Ownership

- Organization: DigitalOcean, LLC
- Network name: DO-13
- Allocated block: 159.223.0.0/16
- ASN: AS14061 (https://ipdebrief.com/asn/14061)
- Regional registry: ARIN
- Cloud / hosting provider: DigitalOcean

## Location

- City: North Bergen
- Region: New Jersey
- Country: United States
- Time zone: —

## Network classification

- Infrastructure type: CloudCompute
- Datacenter / hosting: yes
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (65/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Exposed services

- 22/tcp — ssh

## Analyst narrative

\# IP INTELLIGENCE BRIEFING

**Target:** 159.223.97.218/32

**Classification:** Moderate Risk Cloud Infrastructure Host

**Report Date:** Current Analysis

**Analyst:** IPDebrief Intelligence Team

\---

\## EXECUTIVE SUMMARY

Target IP 159.223.97.218 is a DigitalOcean cloud compute instance with an overall risk score of 65/100 (Moderate Risk). The address demonstrates elevated threat indicators including DNS blacklist presence and geolocation inconsistencies. The IP operates within a subnet showing moderate abuse density (50%), with neighboring addresses exhibiting lower risk profiles.

\---

\## OWNERSHIP & NETWORK CLASSIFICATION

\- **Organization:** DigitalOcean, LLC

\- **ASN:** 14061

\- **Network Name:** DO-13

\- **CIDR Block:** 159.223.0.0/16

\- **Infrastructure Type:** CloudCompute

\- **Hosting Status:** True (Single-Service Host)

\- **Network Role:** Cloud Infrastructure Provider

\---

\## GEOLOCATION ANALYSIS

\- **Claimed Location:** New Jersey, North Bergen, US

\- **Geolocation Confidence:** False (Invalid)

\- **RTT Validation:** 22.0ms observed vs. 119.3ms minimum required for claimed 5,963km distance

\- **Violation Status:** RTT distance implausibility detected (5963km claimed vs. 22ms observed)

\- **Probe Count:** 5

\- **Conclusion:** Geolocation data flagged as implausible; actual location likely different from claimed US datacenter

\---

\## THREAT INDICATORS

\- **Risk Score:** 65/100 (Moderate Risk)

\- **Abuse Confidence:** Present (signals detected)

\- **DNSBL Status:** Listed on 2 of 8 DNSBL lists

\- **Known Attacker:** False

\- **Tor Exit Node:** False

\- **Spam Source:** False

\- **Known Campaigns:** None detected

\- **Blacklist Count:** 2 active listings

\---

\## NETWORK SERVICES

\- **Open Ports:** TCP/22 (SSH)

\- **SSH Banner:** SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.18

\- **TLS Certificate:** None detected

\- **HTTP Services:** None active

\- **DNS Resolution:** No PTR records; no forward resolution

\---

\## OBSERVATION HISTORY

**Total Observations:** 22 signals recorded

**Recent Activity (2026-08-05):**

\- **Blacklist Activity:** IP listed on 3 of 8 blacklist sources (high severity)

\- **Geolocation Signal:** US attribution with 0.18 confidence; coordinates 39.83, -98.58 (Kansas region, inconsistent with claimed NJ)

\- **Operator Score:** 0.1304 (Minimal operator reputation)

\- **Threat Persistence:** Single threat observation; not persistently malicious

\---

\## NEIGHBORHOOD ANALYSIS

**Subnet:** 159.223.97.218/24

| Metric | Value |

|--------|-------|

| Abuse Density | 50% |

| Subnet Classification | Mostly Clean |

| Total Siblings | 4 |

| Active Siblings | 3 |

| Threat Siblings | 2 |

**Neighbor Risk Profiles:**

\- 159.223.97.27: Risk Score 25/100 (Low)

\- 159.223.97.71: Risk Score 25/100 (Low)

\- 159.223.97.91: Risk Score 25/100 (Low)

**Assessment:** Target IP significantly higher risk than subnet peers.

\---

\## RELATIONSHIP GRAPH

\- **Related Networks:** DO-13 (159.223.0.0/16)

\- **Relationship Count:** 7

\- **Relationship Types:** Same Network (all instances)

\- **Associated Organizations:** None detected beyond DigitalOcean

\- **Hostnames/Certificates:** None detected

\---

\## RECOMMENDED ACTIONS

\### IMMEDIATE ACTIONS

1. **Monitor Activity:** Increase logging verbosity and review recent traffic patterns from this IP

2. **Threat Assessment:** Evaluate if current activity warrants blocking based on organizational policy

\### FIREWALL RECOMMENDATIONS

\- **iptables:** \`iptables -A INPUT -s 159.223.97.218 -j DROP\`

\- **nftables:** \`nft add rule inet filter input ip saddr 159.223.97.218 drop\`

\- **nginx:** \`deny 159.223.97.218;\`

\- **pfSense:** Block 159.223.97.218/32

\- **Cloudflare WAF:** Block expression \`ip.src eq 159.223.97.218\`

\- **AWS WAF:** Add IP 159.223.97.218/32 to block list

\---

\## ANALYST NOTES

\- Risk score elevation (65) driven by DNSBL presence and geolocation inconsistencies

\- Cloud infrastructure hosting (DigitalOcean) suggests potential for legitimate use or abuse

\- Geolocation validation failure indicates potential spoofing or misconfigured server metadata

\- Neighboring IPs in same /24 subnet show significantly lower risk (25/100)

\- No active malicious campaigns or threat intelligence matches detected

\- Consider context-dependent blocking: evaluate against existing threat feeds and organizational policies

\---

**END OF BRIEFING**

## Nearby addresses

- 159.223.97.27 (https://ipdebrief.com/159.223.97.27)
- 159.223.97.71 (https://ipdebrief.com/159.223.97.71)
- 159.223.97.91 (https://ipdebrief.com/159.223.97.91)

---

Source: IPDebrief, "159.223.97.218 IP intelligence", https://ipdebrief.com/159.223.97.218, updated 2026-11-02. Assessments are probabilistic.