165.227.163.170📋 Copy

IP Intelligence Briefing: 165.227.163.170

Date: 2026-06-09

---

**1. Core Profile**

• Risk Score: 59 (Moderate Risk)
• Provider: DigitalOcean, LLC (ASN 14061)
• Network Role: Tor Exit Node (classified as "provider" in network infrastructure)
• Geolocation: United States (no specific city/region data available)
• Threat Indicators:

- Tor exit node activity detected

- Listed in 2 DNSBLs (open resolver abuse)

- Self-signed TLS certificate (CN: `api-dev.812g9l1q3.com`)

---

**2. Observation History**

• Recent Activity (2026-06-09):

- Tor exit node signals observed (1 high-severity threat listing).

- Network stability score: 0.35 (Basic operator risk).

- DNSSEC validation: Enabled.

- BGP route stability: Stable (no recent changes).

• Trend: No persistent malicious activity detected; threat observation count is low.

---

**3. Relationships**

• Network Affiliation:

- Part of DigitalOcean’s `165.227.0.0/20` subnet.

- Linked to 218+ IPs in the same subnet (all classified as "Same Network").

• Threat Connections:

- No direct links to known malicious organizations or campaigns.

---

**4. Neighborhood Analysis**

• Subnet: `165.227.163.170/24`
• Abuse Density: 0% (no malicious activity detected in subnet).
• Neighbors: No active IPs in the subnet (likely a single-host subnet).

---

**5. Service & Technical Details**

• Open Ports:

- HTTP (80), HTTPS (443), SSH (22).

- SSH banner: `SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.15`.

• Web Server: Nginx/1.18.0 (Ubuntu).
• TLS Certificate:

- Self-signed (issuer/subject: `api-dev.812g9l1q3.com`).

- No SANs listed.

---

**6. Recommendations**

• Monitor Traffic: Track outbound connections from this IP, as Tor exit nodes are often used for C2 or data exfiltration.
• Block/Restrict: Consider blocking traffic from this IP unless it’s explicitly required for legitimate Tor-based operations.
• Verify Certificate: Investigate the self-signed TLS certificate to ensure it’s not a spoofing attempt.
• Subnet Review: Confirm DigitalOcean’s subnet compliance with security policies, as Tor exit nodes can be exploited for malicious purposes.

---

Conclusion: This IP is a Tor exit node associated with DigitalOcean. While its risk score is moderate, its role in the Tor network and DNSBL listings warrant further investigation. SOC teams should prioritize monitoring and restrict traffic unless the IP is verified as benign.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.