159.65.17.139📋 Copy

IP INTELLIGENCE BRIEFING: 159.65.17.139

Classification: Moderate Risk | Risk Score: 50

Date: 2026-08-12

Analyst: SOC Threat Intelligence

---

**Executive Summary**

IP address 159.65.17.139 is a DigitalOcean cloud infrastructure endpoint hosting a web service. The IP presents moderate risk (score 50) with mixed geolocation signals and minimal operator reputation. No active threat campaigns or known malicious activity indicators were observed.

---

**Ownership & Infrastructure**

• Organization: DigitalOcean, LLC
• ASN: 14061
• CIDR Block: 159.65.0.0/16
• Network Name: DIGITALOCEAN-159-65-0-0
• Infrastructure Type: Cloud Compute / Hosting
• Service Purpose: Web Server

**Geolocation**

• Location: London, ENG, US
• Confidence: Mixed signals (2 sources, consensus: false)
• RTT Metrics: Min 96ms, Avg 100ms

---

**Network Services & Fingerprinting**

• Server Banner: nginx/1.24.0 (Ubuntu)
• TLS Certificate: CN=form.davidschristiancentre.org (Let's Encrypt, US)
• HTTP Status: 301 (Permanent Redirect)
• DNSSEC: Valid

---

**Threat Indicators**

• Blacklist Status: Not flagged as known attacker, spam source, or Tor exit
• DNSBL Listings: 2 of 8 total lists
• Abuse Confidence Score: Not assigned
• Known Campaigns: None detected
• Threat Persistence: Not persistently malicious

---

**Observation History**

• Total Observations: 21 signals
• Recent Activity: August 2026 period shows multiple HTTP fingerprint observations
• Threat Signals: 1 observation flagged threats (Pulse count: 3)
• Route Stability: Not stable (route changes detected in 30-day window)

---

**Neighborhood Analysis (159.65.17.0/24)**

• Abuse Density: 0
• Subnet Classification: Mostly clean
• Active Siblings: 1
• Threat Siblings: 1
• Inherited Risk: 2

---

**Security Recommendations**

Based on risk score of 50 and observed DNSBL listings, consider the following mitigations:

---

**Intel Assessment**

This IP belongs to DigitalOcean's cloud infrastructure in the London region. The endpoint hosts a legitimate web service with standard web hosting configuration. Moderate risk rating is driven by DNSBL presence and route instability rather than confirmed malicious activity. No immediate threat indicators suggest blocking; however, the DNSBL listings warrant monitoring. The associated domain (form.davidschristiancentre.org) should be verified if this IP appears in malicious activity contexts.

Recommendation: Monitor for increased threat signals before implementing blocking controls.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.