162.243.114.126📋 Copy

# IP Intelligence Briefing: 162.243.114.126

Classification: Cloud Infrastructure / Low Risk with Neighborhood Contamination

Report Date: 2026-06-28

Risk Score: 25/100 (Low Risk)

---

## Executive Summary

IP address 162.243.114.126 is a DigitalOcean cloud infrastructure endpoint hosting web services. While the IP itself presents low-risk characteristics (risk score 25), the associated /24 subnet exhibits elevated abuse density (1.0) with one high-risk neighbor (162.243.114.171, risk score 80). The target hosts a South African-registered domain (do2.weexcel.co.za) on outdated Apache server software, presenting moderate vulnerability concerns. No active malicious campaigns detected.

---

## Network Infrastructure

---

## Service Analysis

Open Ports:

• TCP/80 (HTTP)
• TCP/443 (HTTPS)

Server Fingerprint:

• Apache HTTP Server 2.2.27
• OpenSSL 1.0.1e-fips
• PHP 5.3.28

TLS Certificate Analysis:

• Issuer: CN=tmp-ade573.xyz
• Subject: CN=tmp-ade573.xyz
• Subject Alternative Names: tmp-ade573.xyz, mail.tmp-ade573.xyz, www.tmp-ade573.xyz, webdisk.tmp-ade573.xyz, webmail.tmp-ade573.xyz
• Certificate status: Self-signed or unusual issuer (requires validation)

DNS Resolution:

• PTR Hostname: do2.weexcel.co.za
• Forward Resolution: do2.weexcel.co.za
• Domain Registration: co.za (South Africa)

---

## Threat Indicators

Control Plane Assessment:

• Operator Score: 0.2609 (Basic)
• DNSSEC: Valid
• Route Stability: Unstable (routeChanges30d: 0)

---

## Neighborhood Analysis

Subnet: 162.243.114.126/24

• Abuse Density: 1.0 (Critical)
• Total Siblings: 2
• Active Siblings: 2
• Threat Siblings: 1

High-Risk Neighbor Identified:

• IP: 162.243.114.171
• Risk Score: 80
• Authority Score: 60

Assessment: The target IP shares a subnet with confirmed malicious activity. While the target maintains a low individual risk score, the neighborhood contamination suggests potential lateral threat vectors or shared infrastructure risk.

---

## Historical Observations

Total Observations: 22

Recent Activity Timeline:

• 2026-06-28 02:45: Cloud infrastructure classification (DigitalOcean, hosting)
• 2026-06-20 00:43: HTTP 404 responses detected
• 2026-06-20 00:38: Operator score assessment (0.2609)

Geolocation Discrepancy:

• Inferred Location: 39.83°N, -98.58°W (US)
• Confidence: 0.325
• RTT Violation: 25ms observed vs. 119.3ms minimum required for 5,966km distance

Assessment: Geolocation data shows significant inconsistency, suggesting the IP may be routed through multiple points or the inference models are unreliable.

---

## Relationship Graph

Total Relationships: 63

Primary Associations:

• Network: DIGITALOCEAN-162-243-0-0 (multiple instances)
• DNS: do2.weexcel.co.za

---

## Recommended Actions

Immediate:

• Monitor subnet 162.243.114.126/24 for additional high-risk activity
• Validate TLS certificate authenticity for tmp-ade573.xyz domain
• Review outbound connections from 162.243.114.171 (high-risk neighbor)

Firewall Configuration:

• No specific blocking recommendations generated based on current risk profile
• Consider blocking high-risk neighbor 162.243.114.171 if within scope

Vulnerability Mitigation:

• Apache 2.2.27 and OpenSSL 1.0.1e-fips are significantly outdated
• Recommend service upgrade or replacement to address known CVEs

---

## Threat Intelligence Conclusion

IP 162.243.114.126 represents a low-risk cloud infrastructure endpoint with moderate infrastructure concerns. The primary intelligence value lies in neighborhood association with confirmed malicious activity (162.243.114.171, risk score 80). While the target IP itself shows no direct malicious indicators, SOC analysts should:

1. Monitor for lateral movement or shared infrastructure compromise

2. Verify TLS certificate legitimacy

3. Consider blocking high-risk neighbor if within organizational scope

4. Track any changes in DNS blacklist status or neighborhood abuse density

Confidence Level: Moderate

Campaign Association: None detected

Recommended Priority: Monitor

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.