165.227.85.153
# Intelligence Briefing: 165.227.85.153/32
Classification: MODERATE RISK — Cloud Infrastructure
Date: 2026-08-13
Analyst: IPDebrief Intelligence
---
## Executive Summary
IP 165.227.85.153 is a DigitalOcean cloud compute host registered in the US. The IP carries a risk score of 50 (moderate) but presents minimal active threat indicators. No open services or threat behaviors observed. Recommended for monitoring or blocking depending on organizational threat tolerance.
---
## Ownership & Classification
| Attribute | Value |
|---|---|
| **Organization** | DigitalOcean, LLC |
| **ASN** | 14061 |
| **Network** | DIGITALOCEAN-165-227-0-0 (165.227.0.0/16) |
| **Infrastructure Type** | CloudCompute |
| **Cloud Provider** | DigitalOcean |
| **Hosting** | Yes |
---
## Geolocation
| Attribute | Value |
|---|---|
| **Country** | United States (US) |
| **Region** | New Jersey |
| **City** | North Bergen (reported: New York in transit data) |
| **Coordinates** | Latitude/longitude not available |
| **GeoPlausibility** | Valid (5,963 km from probe origin) |
| **ICMP Validation** | Blocked |
*Note: Transit data observed via Cogent/Cogent hop (be3471.ccr41.jfk02.atlas.cogentco.com) indicates routing through JFK transit infrastructure.*
---
## Threat Indicators
| Indicator | Status |
|---|---|
| Known Attacker | No |
| Spam Source | No |
| Tor Exit Node | No |
| Blacklist Count | 2 (of 8 total DNSBLs) |
| Abuse Confidence Score | Not available |
| Known Campaigns | None |
| Threat Persistence | 0 days |
---
## Network Behavior
| Attribute | Value |
|---|---|
| **Open Ports** | None detected |
| **HTTP/TLS Services** | None |
| **DNS Records** | No PTR, no forward resolution |
| **Email Auth** | SPF/DMARC not detected |
| **Server Banner** | None |
| **Fingerprint** | None |
---
## Historical Observations
- Total Signals: 17 observations
- Threat Observation Count: 0
- ICMP Validation: Blocked (unable to validate geolocation)
- Campaign Likelihood: None
- Correlated IPs: 0
- Certificate Matches: 0
Recent signals indicate no active malicious behavior. The IP has been observed primarily for geolocation and network probing activities.
---
## Neighborhood Analysis
- Subnet: 165.227.85.0/24
- Abuse Density: 0%
- Neighbor Count: 0
- Risk Distribution: No neighbors detected in immediate /24 scope
---
## Recommended Actions
The system recommends blocking this IP address. Below are firewall rules for deployment:
| Platform | Rule |
|---|---|
| **iptables** | `iptables -A INPUT -s 165.227.85.153 -j DROP` |
| **nftables** | `nft add rule inet filter input ip saddr 165.227.85.153 drop` |
| **nginx** | `deny 165.227.85.153;` |
| **pfSense** | `165.227.85.153/32` |
| **Cloudflare WAF** | Block expression: `ip.src eq 165.227.85.153` |
| **AWS WAF** | `Addresses: ["165.227.85.153/32"]` |
---
## SOC Analyst Assessment
This IP is a DigitalOcean cloud host with moderate risk scoring but no active threat behaviors detected. The primary risk factors are:
- DNSBL listing on 2 of 8 checks
- Moderate risk score (50/100)
Recommendation: Implement blocking if the IP appears in inbound traffic logs. No immediate malicious activity detected. Monitor for changes in behavior patterns. The IP should be placed on a watchlist for 30 days to observe for any behavioral changes.
Confidence Level: Medium — Cloud hosting infrastructure with minimal observable threats.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | DigitalOcean, LLC |
| ASN | AS14061 |
| Network Name | DIGITALOCEAN-165-227-0-0 |
| CIDR Block | 165.227.0.0/16 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 37% | 2 | 3 |
| routing | 13% | 1 | 1 |
| services | 19% | 2 | 2 |
| ownership | 27% | 2 | 3 |
| reputation | 17% | 1 | 2 |
| geolocation | 27% | 2 | 3 |
| Overall | 23% | 10 | 14 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-08-13 00:39:29 UTC |
| Last Seen | 2026-08-30 20:45:30 UTC |
| Profile Built | 2026-08-29 03:23:52 UTC |
| Data Freshness | Live |
| Signal Types | 20 |
| Total Observations | 24 |
Full dossier details are available via our API.