167.172.91.43📋 Copy

# IP INTELLIGENCE BRIEFING: 167.172.91.43/32

Date: Current Assessment

Classification: Moderate Risk

Primary Provider: DigitalOcean (ASN 14061)

## EXECUTIVE SUMMARY

IP address 167.172.91.43 operates as a cloud-hosted web server within the DigitalOcean infrastructure. The IP presents moderate risk (score: 50) with no direct threat indicators. The address is geolocated to Singapore and exhibits standard hosting characteristics. While no malicious activity has been directly observed, the IP appears on 2 of 8 DNSBL lists, suggesting prior reputation concerns.

## TECHNICAL PROFILE

Ownership & Classification:

• ASN: 14061 (DigitalOcean)
• CIDR Block: 167.172.0.0/16
• Infrastructure Type: Cloud Compute / Hosting
• Network Role: Web Server

Geolocation:

• Country: Singapore (SG)
• Consensus: Validated across multiple sources

Network Services:

• Port 80/TCP (HTTP)
• Port 443/TCP (HTTPS)
• Server: nginx (HTTP/2.0 enabled)
• TLS: TLS 1.3 with cipher suite TLS_AES_256_GCM_SHA384

Route Stability:

• BGP Prefix: 167.172.80.0/20
• Route Stability: Not stable
• RPKI State: Not evaluated

## THREAT ASSESSMENT

Risk Score: 50/100 (Moderate)

Threat Indicators: None observed

• Not identified as known attacker
• Not Tor exit node
• Not spam source
• No active threat campaigns detected

Reputation Signals:

• DNSBL Listed: 2 of 8 total lists
• Abuse Confidence Score: Not computed
• Operator Score: 0.1304 (Minimal)

## OBSERVATION HISTORY

Total Observations: 17 signals recorded

Temporal Patterns:

• Most recent activity: August 2026
• HTTP status codes observed: 403 (Forbidden)
• Server response time: 739ms average
• TLS certificate validation: Valid, not self-signed
• ICMP validation: Blocked (unable to validate geolocation via ICMP)

Signal Consistency:

• Operator score remained stable at 0.1304 across observations
• No evidence of escalating threat behavior
• Ownership changes: None recorded

## NEIGHBORHOOD ANALYSIS

Subnet: 167.172.91.43/24

Subnet Metrics:

• Abuse Density: 0.0 (Clean classification)
• Total Siblings: 2
• Active Siblings: 1
• Threat Siblings: 0

Adjacent IP Analysis:

• 167.172.91.222: Risk Score 25 (Low)
• No correlated malicious activity detected in immediate vicinity

## RELATIONSHIP GRAPH

Identified Connections: 5 relationships

• Multiple links to DigitalOcean network infrastructure
• No associations with known malicious entities
• No certificate or hostname correlations indicating command-and-control infrastructure

## RECOMMENDED ACTIONS

Immediate Mitigation:

Block this IP at perimeter defenses:

```

iptables -A INPUT -s 167.172.91.43 -j DROP

nft add rule inet filter input ip saddr 167.172.91.43 drop

```

WAF Configuration:

Cloudflare WAF:

```json

{

"description": "Block 167.172.91.43 — IPDebrief risk score 50",

"action": "block",

"filter": {"expression": "ip.src eq 167.172.91.43"}

}

```

AWS WAF:

```json

{

"Addresses": ["167.172.91.43/32"],

"Description": "IPDebrief risk 50"

}

```

SOC Analyst Notes:

While the IP presents moderate risk and appears on multiple DNSBL lists, no active threat indicators were observed. The DigitalOcean hosting environment and clean neighborhood classification suggest this may be a misconfigured or previously flagged hosting instance rather than active threat infrastructure. Monitor for escalation in threat scores or new DNSBL listings. Consider allowing traffic if business requirements exist, but maintain logging for forensic analysis.

---

Disclaimer: Risk assessments are probabilistic and should be combined with other threat intelligence signals before taking operational action.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.