167.71.190.221📋 Copy

# Intelligence Briefing: 167.71.190.221/32

Classification: LOW RISK

Date: 2026-06-21

Provider: DigitalOcean, LLC (ASN 14061)

## Executive Summary

IP address 167.71.190.221 operates within the DIGITALOCEAN-167-71-0-0 network (167.71.0.0/16) as a cloud infrastructure host. The IP maintains a low-risk profile with a risk score of 25 and shows no active threat indicators. No firewall rules were recommended for blocking or filtering at this time.

## Profile Overview

Risk Assessment: The IP registered a risk score of 25, categorized as "Low Risk." Provider and authority scores were null, indicating minimal threat attribution. The IP is classified as a cloud compute host (Infrastructure Type: CloudCompute) with service purpose identified as "Single-Service Host."

Network Classification: The address operates on DigitalOcean infrastructure (ASN 14061). Control plane analysis identified the IP as stable with route changes of zero over the past 30 days. RPKI state and IRR consistency data were unavailable. DNSSEC validation was confirmed as valid.

Geolocation: The IP resolved to Clifton, New Jersey, United States. Geolocation consensus was validated across multiple sources, though geo-validation flags indicated implausibility with a 5,967 km distance discrepancy and 20ms RTT against a minimum possible 119.4ms threshold for that distance.

DNS Resolution: Forward DNS resolution confirmed the hostname "southnode.netcluescloud.com." Email authentication records (SPF, DMARC) were present for the associated domain.

## Threat Indicators

No active threat indicators were detected. The IP was not identified as:

• A Tor exit node
• A known attacker
• A spam source
• Listed on any blacklists (count: 0)

Campaign correlation analysis returned no matches, with zero correlated IPs and zero certificate matches.

## Historical Observation Analysis

Observation history contains 24 signals across multiple signal types. The most recent observations occurred on 2026-06-21. Analysis confirmed:

• No persistent malicious activity
• No ownership changes
• No threat persistence

Signal types included network classification (cloud infrastructure), subnet abuse density monitoring, and geolocation inference.

## Infrastructure and Relationships

The IP maintains 33 relationship entries, including:

• DNS associations with southnode.netcluescloud.com
• Network associations within the DIGITALOCEAN-167-71-0-0 CIDR block

Open port scanning identified SSH (port 22/tcp) with banner "SSH-2.0-OpenSSH_7.4." No TLS certificates or HTTP services were detected.

## Neighborhood Analysis

The /24 subnet (167.71.190.221/24) showed an abuse density of 1 with classification "mostly_clean." One threat sibling was identified among active siblings.

## Recommended Actions

No specific security actions or firewall rules were generated based on the current risk profile. The IP presents minimal threat and does not require immediate blocking or filtering measures.

Monitoring Recommendation: Continue routine observation. The low-risk profile and clean threat indicators suggest standard monitoring is sufficient.

---

*Intelligence generated via IPDebrief platform. All data derived from observed network signals.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.