167.172.207.27📋 Copy

IP Intelligence Briefing: 167.172.207.27

Date: 2026-06-16

1. Core Profile

• Risk Score: 25 (Low Risk)
• Provider: DigitalOcean (ASN 14061)
• Geolocation: Santa Clara, CA, US (geoPlausible: false)
• Network Role: CloudCompute (DigitalOcean droplet)
• Services: Open SSH (port 22) with banner "SSH-2.0-OpenSSH_8.9p1". No other services detected.

2. Threat Indicators

• No malicious indicators, spam, or abuse confidence detected.
• Not listed in DNSBLs, Tor exits, or known attacker databases.
• Zero threat observations in 30 days.

3. Network Relationships

• DNS Associations: Linked to `prod-boron-sfo2-89.do.binaryedge.ninja` (repeated entries).
• Subnet: Part of DigitalOcean’s infrastructure (167.172.0.0/16).
• Subnet Classification: Mostly clean (abuse density: 1).

4. Neighborhood Analysis

• Subnet: 167.172.207.27/24
• Neighbors: No active sibling IPs detected (zero neighbors returned).

5. Temporal Observations

• Latest Activity: June 11, 2026, with SSH service and geo validation anomalies (RTT < minimum expected for distance).
• Stability: Unchanged ownership and no persistent malicious activity.

6. Recommendations

• Monitor: DNS hostnames (`prod-boron-sfo2-89.do.binaryedge.ninja`) for unexpected changes.
• Verify: Geo validation anomalies may indicate misconfigured probes or false positives.
• Baseline: Establish SSH access patterns for the droplet, as no other services are exposed.

Conclusion:

This IP is a legitimate DigitalOcean droplet with no current malicious activity. The geo validation discrepancy and lack of subnet neighbors warrant further investigation, but the overall risk profile remains low. No immediate action required; monitor for deviations in network behavior or threat indicators.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.