167.172.66.94📋 Copy

# IP Intelligence Briefing: 167.172.66.94

## Executive Summary

This IP address operates as a cloud infrastructure endpoint within the DigitalOcean network. The profile indicates minimal threat posture with a risk score of 25 (Low Risk). No active malicious indicators, campaigns, or persistent threat behavior were detected. The IP serves as a standard multi-service host in a Singapore-based cloud environment.

---

## Infrastructure Profile

Ownership & Classification

• ASN: 14061 (DigitalOcean, Inc.)
• Organization: DigitalOcean
• Infrastructure Type: CloudCompute
• Network Role: Multi-Service Host, Cloud Infrastructure
• CIDR Block: 167.172.64.0/20
• BGP Prefix: 167.172.64.0/20

Geolocation

• Country: Singapore (SG)
• Coordinates: 1.35°N, 103.82°E
• Timezone: Asia/Singapore
• Accuracy Radius: 45 km
• RTT: 238ms average (validated geolocation)

---

## Service Exposure

Open Ports & Services

HTTP Fingerprint

• Server: nginx/1.24.0 (Ubuntu)
• Status Code: 404 (Not Found)
• Security Headers: HSTS enabled, CSP present, Referrer Policy configured
• HTTP Version: 1.1

---

## Threat Assessment

Risk Metrics

• Overall Risk Score: 25 (Low)
• Provider Score: 0
• Authority Score: 0
• Abuse Confidence Score: N/A
• Operator Score: 0.1304 (Minimal)

Malicious Indicators

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0
• Known Campaigns: None

Control Plane Signals

• DNSBL Listed: 1 of 8 lists
• Route Changes (30d): 0
• Route Stability: Unstable
• DNSSEC Validation: Valid

---

## Neighborhood Analysis

Subnet: 167.172.66.94/24

• Abuse Density: 0
• Classification: mostly_clean
• Total Siblings: 1
• Active Siblings: 1
• Threat Siblings: 1
• Inherited Risk: 2

The subnet exhibits minimal abuse density with one active sibling showing threat signals. No high-risk neighbors were identified.

---

## Historical Observations

Observation Count: 23 signals recorded

• Latest Observation: 2026-06-28T17:13:54
• Threat Persistence: 0 days
• Ownership Changes: 0
• Signal Confidence: Variable (0.23–0.90)

Historical data shows consistent cloud infrastructure behavior with no escalation in threat activity. One threat observation recorded without evidence of persistent malicious use.

---

## Relationship Graph

Connected Entities: 22 relationships

• All relationships classified as "Same Network" (DigitalOcean)
• No external threat actor associations
• No certificate or domain relationships

---

## Recommended Actions

Security Posture: No immediate action required

• No firewall rules recommended
• No blocking actions advised
• Risk profile indicates benign cloud infrastructure

Monitoring Recommendations

• Monitor DNSBL listing status (1 of 8 lists)
• Track route stability changes
• Observe subnet-level threat activity
• Standard cloud infrastructure monitoring applies

---

## Intelligence Narrative

IP 167.172.66.94 operates as a standard DigitalOcean cloud infrastructure endpoint based in Singapore. The address presents minimal security concern with a risk score of 25. Open services include HTTP and SSH, typical for cloud hosting environments. No malicious indicators, known attacker associations, or campaign correlations were identified. The subnet environment remains clean with low abuse density. The single DNSBL listing represents minor concern but does not indicate active malicious activity. Standard defensive monitoring practices apply. No immediate blocking or mitigation actions are warranted.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.