167.99.107.57📋 Copy

# IP Intelligence Briefing: 167.99.107.57

Classification: Moderate Risk / Cloud Infrastructure

Report Date: Current

Risk Score: 40/100

## Executive Summary

IP 167.99.107.57 is a DigitalOcean cloud compute instance operating as a single-service host with SSH access enabled. The IP demonstrates moderate risk characteristics with DNSBL listings and geolocation validation anomalies. No persistent malicious activity observed.

## Technical Profile

Ownership & Routing:

• ASN: 14061 (DigitalOcean, LLC)
• BGP Prefix: 167.99.96.0/20
• Origin ASN: 14061 via AS2914 (NTT)
• Route Stability: Stable (zero changes in 30 days)
• RIR: ARIN (allocated 2012-09-25)

Geolocation:

• Reported Location: Santa Clara, CA, US
• Validation Status: GEOLOCATION IMPLAUSIBLE
• RTT Analysis: 88ms observed vs minimum 177.25ms required for claimed distance (8,863km)
• Distance Violation: RTT 88.0ms < minimum possible 177.25ms for 8863km

Network Services:

• Port 22/TCP (SSH): Open, SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.13
• DNS Resolution: 5b5593d5a9.research-scanner.com (forward unconfirmed)
• Email Auth: SPF present, DMARC absent

Threat Indicators:

• DNSBL Listings: 2 of 8 lists
• Abuse Confidence: None reported
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

## Neighborhood Analysis

Subnet: 167.99.107.57/24

• Abuse Density: 0 (mostly clean classification)
• Total Siblings: 1 (self only)
• Threat Siblings: 1
• Inherited Risk: 2

## Historical Observations

25 signal observations recorded. Routing and ASN assignments remain stable. Single threat observation detected. Geo validation inconsistencies persist across observations.

## Associated Entities

• Networks: 53 relationships identified, primarily DIGITALOCEAN-167-99-0-0
• Campaigns: None correlated
• Certificates: None associated

## Recommended Actions

Firewall Rules (Recommended for Risk Score 40):

## SOC Analyst Assessment

This IP represents a cloud-hosted service with moderate risk posture. The geolocation implausibility suggests either misconfigured reporting or potential proxy usage. SSH exposure on a single-service host warrants attention but does not indicate active exploitation. The absence of persistent malicious signals and stable routing indicate this is likely a legitimate cloud infrastructure endpoint with minor reputation issues. Monitor for escalation in DNSBL listings or SSH activity patterns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.