167.172.77.62📋 Copy

# IP Intelligence Briefing: 167.172.77.62

## Executive Summary

IP 167.172.77.62 is a Low Risk (Risk Score: 30/100) web server endpoint hosted on DigitalOcean cloud infrastructure in Singapore. The IP demonstrates stable operational characteristics with no active malicious indicators, though the /24 neighborhood shows minor abuse activity that warrants contextual awareness.

---

## Infrastructure Profile

## Service Footprint

The IP hosts standard web server services with the following open ports:

• Port 80/tcp: HTTP
• Port 443/tcp: HTTPS
• Port 22/tcp: SSH (OpenSSH 9.6p1 Ubuntu)
• Port 8080/tcp: HTTP-alt

TLS Configuration: The endpoint presents a Let's Encrypt certificate for `crmsaudi.dev` with SANs covering `*.crmsaudi.dev` and `crmsaudi.dev`. Server fingerprint identifies nginx/1.24.0 on Ubuntu. Security headers include HSTS (31536000s), CSP (default-src 'self'), and HTTP/2 support.

## Threat Assessment

• Overall Risk: Low Risk (Score: 30)
• Known Threats: None
• Blacklist Status: Listed on 1 of 8 DNSBL checks (minor concern)
• Campaign Activity: No correlation with known malicious campaigns
• Tor/Proxy/VPN: Negative indicators
• Abuse Confidence: Not available

## Operational History

Analysis of 25 observation signals reveals consistent operational patterns:

• Ownership remains stable with zero changes
• No persistent malicious behavior detected
• Recent observations (June 2026) show stable configuration
• Security headers (CSP, HSTS, Referrer-Policy) present and properly configured
• Average response time: ~237ms

## Network Neighborhood

The /24 subnet (167.172.77.0/24) shows:

• Abuse Density: 1 (low)
• Classification: Mostly Clean
• Active Siblings: 1
• Threat Siblings: 1

The presence of one threat sibling in the neighborhood suggests localized abuse activity, though the target IP itself maintains a clean threat profile.

## Security Actions

No specific firewall rules or mitigation recommendations are required at this time. The IP's low risk score and absence of active threat indicators support continued monitoring without immediate blocking actions.

## Intelligence Conclusion

IP 167.172.77.62 operates as a legitimate web hosting endpoint on DigitalOcean infrastructure. The endpoint hosts what appears to be a development or test environment (`crmsaudi.dev`). While the immediate threat profile is low, SOC analysts should maintain awareness of the neighborhood's abuse density and monitor for any changes in the threat sibling activity. No immediate defensive actions are warranted.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.