165.22.80.109📋 Copy

# IP Intelligence Briefing: 165.22.80.109

Classification: LOW RISK | Report Date: 2026-06-14

## Executive Summary

IP address 165.22.80.109 is a DigitalOcean cloud infrastructure endpoint located in Frankfurt am Main, Germany. The IP maintains a low-risk profile (Risk Score: 25) with no active threat indicators. Infrastructure is classified as cloud computing with no open services detected.

## Ownership & Infrastructure

• Owner: DigitalOcean, LLC
• ASN: AS14061
• Location: Frankfurt am Main, DE (50.1188°N, 8.6843°E)
• Network Block: 165.22.80.0/20
• Infrastructure Type: CloudCompute
• Ownership: Stable (no changes recorded)

## Threat Assessment

• Risk Score: 25 (Low Risk)
• Blacklist Status: 0 blacklists
• DNSBL Listings: 1 of 8 total lists
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

## Network Behavior

• Services: No open ports detected; firewalled/no services exposed
• DNS: No PTR records; no forward resolution
• SSL/TLS: No certificates detected
• HTTP: No web services detected

## Control Plane Analysis

• Operator Score: 0.1304 (Minimal)
• Route Stability: Not route-stable
• RPKI Status: Not validated
• Delegation Age: Not recorded
• Moas: No

## Temporal Analysis

• Observations: 20 signals tracked
• Threat Persistence: 0 days
• Malicious Persistence: False
• Recent Activity: Single threat observation noted

## Neighborhood Context (165.22.80.0/24)

• Abuse Density: Low
• Subnet Classification: Mostly Clean
• Threat Siblings: 1 detected in subnet
• Overall Risk: Minimal inherited risk from subnet

## Recommended Actions

Current Status: No specific security actions recommended based on risk profile.

Suggested Monitoring:

• Monitor for service exposure changes
• Track subnet-level threat activity
• Review DNSBL listing details if security policy requires

## SOC Analyst Notes

This IP represents a standard DigitalOcean cloud endpoint with minimal threat indicators. The single threat sibling in the /24 subnet warrants awareness but does not indicate direct compromise. No immediate blocking or mitigation required. Standard cloud infrastructure monitoring applies.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.