159.65.2.17📋 Copy

## IP Intelligence Briefing: 159.65.2.17/32

Classification: Moderate Risk (Score: 65)

Data Collection Date: 2026-06-20

Analysis Period: 22 signal observations

Executive Summary

IP 159.65.2.17 is a DigitalOcean cloud infrastructure host located in Singapore, operating as a web server with moderate risk indicators. The IP demonstrates proxy/VPN behavior in recent observations and is listed on 3 of 8 DNSBL feeds, though it operates within a clean subnet with no immediate threat siblings.

Network Profile

• ASN: 14061 (DigitalOcean, LLC)
• Organization: DigitalOcean, LLC
• Geolocation: Singapore (SG) — geoconsensus confirmed
• Infrastructure Type: Cloud Computing / Hosting
• Subnet Classification: Clean (abuse density: 0)
• Control Plane: BGP prefix 159.65.0.0/20; route stability: unstable
• DNSBL Status: Listed on 3 of 8 total lists

Technical Services

• Open Ports: 80/TCP (HTTP), 443/TCP (HTTPS), 22/TCP (SSH)
• Web Server: nginx/1.24.0 (Ubuntu)
• TLS Certificate: Let's Encrypt (CN=E8, O=Let's Encrypt, C=US)
• Domain Association: ct.200m.tech
• PTR Record: ct.200m.tech

Threat Indicators

• Risk Score: 65 (Moderate)
• Blacklist Count: 0
• Known Campaigns: None detected
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Abuse Confidence Score: Not available

Recent Signal (2026-06-20): Flagged as proxy/VPN behavior with risk score 66 (confidence: 0.85)

Neighborhood Analysis

Subnet: 159.65.2.17/24

• Total Siblings: 3
• Active Siblings: 1
• Threat Siblings: 0
• Risk Distribution: 2 low-risk, 0 medium/high-risk
• Neighbor IPs:

- 159.65.2.45 (Risk: 25, Authority: 50)

- 159.65.2.115 (Risk: 25, Authority: 50)

Historical Trend

• Observations: 22 total signals
• Threat Persistence: 0 days
• Ownership Changes: 0
• Geo Inconsistencies: Detected (some sources reported US coordinates)
• HTTP Headers: No CSP, HSTS, or HTTP/2 enabled
• SSL Status: Valid Let's Encrypt certificate

Relationship Graph

• 39 relationship entries identified
• Primary association: DIGITALOCEAN-159-65-0-0 network

Recommended Actions

Immediate:

• Monitor for proxy/VPN behavior (recent detection 2026-06-20)
• Review DNSBL listings for specific blocks

Firewall Rules:

• Allow HTTPS (443) and HTTP (80) for business services
• Restrict SSH (22) to authorized source IPs only
• Implement rate limiting based on observed proxy patterns

Investigation Priority: Medium

• No active malicious campaigns detected
• Subnet environment remains clean
• Focus on validating proxy behavior and DNSBL listings

---

*Generated by IPDebrief Intelligence Platform | Authorized Defensive Security Analysis*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.