167.71.195.2📋 Copy

# IP Intelligence Briefing: 167.71.195.2/32

Classification: LOW RISK • Last Updated: 2026-06-22

IP Address: 167.71.195.2

ASN: 14061 (DigitalOcean, LLC)

---

## Executive Summary

The IP address 167.71.195.2 is a DigitalOcean cloud infrastructure endpoint located in Singapore. Current risk assessment indicates low threat activity with a risk score of 25. The IP operates as a cloud compute host with standard web and SSH services. No active malicious indicators or threat campaigns were detected during analysis.

---

## Infrastructure Profile

## Network Services

Open ports identified during passive scanning:

• Port 80/TCP: HTTP
• Port 443/TCP: HTTPS
• Port 22/TCP: SSH (OpenSSH 8.9p1 Ubuntu-3ubuntu0.15)

TLS Certificate analysis reveals a self-signed TRAEFIK certificate with SANs pointing to internal Traefik routing configuration. No external domain associations detected.

---

## Threat Indicators

No malicious threat indicators were identified:

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0
• DNSBL Listings: 1 (minor listing)
• Known Campaigns: None

---

## Neighborhood Assessment

Subnet: 167.71.195.2/24

• Abuse Density: 0.5 (Low)
• Classification: Mostly Clean
• Total Siblings: 2
• Active Siblings: 1
• Threat Siblings: 1

Neighbor Analysis: One adjacent IP (167.71.195.101) shows elevated risk scoring (50), suggesting potential localized activity within the subnet. However, the target IP itself maintains clean classification.

---

## Relationship Graph

The IP maintains 35 relationship associations, predominantly same-network links to DigitalOcean infrastructure. No cross-network, organizational, or certificate-based relationships indicate broader attack infrastructure associations.

---

## Historical Observations

Analysis of 20 historical observations (through 2026-06-22) demonstrates consistent geolocation reporting from Singapore. No significant changes in threat posture, infrastructure classification, or risk indicators observed over the observation period. The IP exhibits stable ownership and classification characteristics.

---

## Recommended Actions

No immediate mitigation actions are recommended based on current risk profile. However, SOC analysts should:

1. Monitor: Maintain observation on the IP for any sudden risk score increases

2. Review Neighbor Activity: Investigate adjacent IP 167.71.195.101 (risk score 50) if threat indicators emerge

3. Baseline: Establish normal traffic patterns for DigitalOcean cloud endpoints in the 167.71.195.0/24 subnet

---

Analyst Notes: This IP represents standard cloud infrastructure with no actionable threat intelligence. The single DNSBL listing and one flagged neighbor IP warrant routine monitoring but do not indicate immediate malicious activity from this specific endpoint.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.