## THREAT INTELLIGENCE BRIEFING
IP Address: 167.172.42.135/32
Date: 2026-08-13
Classification: Moderate Risk Cloud Infrastructure
Executive Summary
IP 167.172.42.135 is a cloud compute address hosted on DigitalOcean (ASN:14061). The IP presents moderate risk (score: 65) due to DNSBL listings and geolocation inconsistencies. No active threat indicators or malicious services detected. Recommended action: Monitor with standard cloud provider rules.
Network Profile
| Attribute | Value |
|---|---|
| Organization | DigitalOcean |
| ASN | 14061 |
| Network | 167.172.0.0/16 |
| Infrastructure Type | CloudCompute |
| Is Hosting | Yes |
| Is Cloud | Yes |
Geolocation
- Primary: Amsterdam, Netherlands (NL)
- Alternative: Broomfield, US (confidence: 0.52)
- Note: Geolocation inconsistency detected between DNS and passive inference signals.
Threat Indicators
- Risk Score: 65 (Moderate)
- DNSBL Listings: 3 of 8 lists (high severity)
- Blacklist Count: 3
- Known Attacker: No
- Tor Exit: No
- Threat Feeds: None active
Observations History
12 total observations recorded. Key signals:
- Ownership consistently attributed to DigitalOcean
- No persistent malicious activity detected
- DNSBL listings observed with high severity ratings
- No threat persistence days recorded
Network Neighborhood
- Subnet: 167.172.42.0/24
- Abuse Density: 0 (no active siblings)
- Neighbor Count: 0
- Classification: None
Relationships
- Connected to DigitalOcean network (2 relationship links)
Service Analysis
- Open Ports: None detected
- HTTP Services: None
- TLS Certificates: None
- Connection Type: Firewall/No Services
Recommended Actions
Based on risk profile and DNSBL listings:
- Monitor for outbound scanning activity from this IP
- Apply standard cloud provider firewall rules
- Investigate any inbound connections from this IP to your infrastructure
- Consider blocking if internal policy requires action on DNSBL-listed IPs
Conclusion
This IP is a legitimate DigitalOcean cloud endpoint with moderate risk due to DNSBL associations. No active threat indicators detected. Standard cloud provider monitoring and firewall rules are appropriate. No immediate blocking required unless additional context indicates compromise or abuse.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
๐ข Ownership & Registration
| Organization | digitalocean |
| ASN | AS14061 |
| Network Name | DigitalOcean |
| CIDR Block | 167.172.0.0/16 |
| RIR | ARIN |
| Country | US |
| Abuse Contact | Available via RDAP |
๐ DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No โ PTR hostname does not resolve back to this IP (weak signal) |
๐ DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
โ๏ธ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Hosting โ Infrastructure provider without advanced routing |
๐ Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | โ |
| HTTP Title | โ |
๐ TLS Certificate
| SANs | None |
| Valid From | โ |
| Valid Until | โ |
๐ฏ Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 27% | 2 | 2 |
| routing | 13% | 1 | 1 |
| services | 19% | 2 | 2 |
| ownership | 27% | 2 | 3 |
| reputation | 13% | 1 | 1 |
| geolocation | 27% | 2 | 3 |
| Overall | 21% | 10 | 12 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
๐ Observation Timeline ๐ Live
| First Seen | 2026-08-13 00:39:30 UTC |
| Last Seen | 2026-08-30 16:15:41 UTC |
| Profile Built | 2026-08-30 16:21:16 UTC |
| Data Freshness | Live |
| Signal Types | 20 |
| Total Observations | 27 |
Full dossier details are available via our API.