167.99.113.81📋 Copy

# IP Intelligence Briefing: 167.99.113.81/32

## Executive Summary

IP address 167.99.113.81 is a low-risk DigitalOcean cloud compute instance operating from the US East Coast (NJ region). The IP presents minimal threat indicators with a risk score of 25 and no active malicious campaigns. However, geolocation validation anomalies warrant monitoring.

## Infrastructure Profile

• Provider: DigitalOcean, LLC (ASN 14061)
• Infrastructure Type: Cloud Compute (Single-Service Host)
• Classification: Cloud hosting infrastructure
• Risk Score: 25/100 (Low Risk)
• Stability: No ownership changes detected

## Geolocation Analysis

• Claimed Location: United States, New Jersey, Clifton (39.83°N, -98.58°W)
• Geolocation Validation: FAILED
• Issue: RTT measurement (18ms) significantly below minimum possible RTT (119.4ms) for claimed distance of 5,968km
• GeoPlausible: False
• Consensus: Conflicting signals across multiple observation points

## Network Services

• Open Ports: 22/TCP (SSH)
• SSH Banner: SSH-2.0-OpenSSH_10.0p2 Debian-7+deb13u4
• DNS: No PTR resolution, no forward resolution
• HTTP/TLS: No web services detected
• Email: No SPF/DMARC records configured

## Threat Indicators

• Blacklist Status: Listed on 1 of 8 DNSBLs
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Active Threat Feeds: None
• Campaign Association: None detected

## Control Plane Data

• BGP Prefix: 167.99.112.0/20
• Operator Score: 0.1304 (Minimal)
• Route Stability: Unstable
• RPKI/IRR: Data insufficient

## Neighborhood Assessment

• Subnet: 167.99.113.0/24
• Abuse Density: 0 (Low)
• Classification: Mostly Clean
• Threat Siblings: 1 detected in subnet
• Active Siblings: 1

## Observation History Summary

• Total Observations: 18 signals
• Threat Persistence: 0 days
• Recent Activity: Conflicting geolocation signals with one observation flagged as implausible due to RTT violation
• Timeline: Single threat observation recorded

## Recommended Actions

1. Monitoring: Add to passive monitoring due to DNSBL listing

2. Validation: Verify actual geographic location of this cloud host

3. Baseline: Establish normal traffic patterns for this DigitalOcean instance

4. Policy: No immediate blocking required; monitor for behavior change

## SOC Notes

This IP represents standard DigitalOcean cloud infrastructure with minimal malicious indicators. The primary concern is the geolocation validation failure, which may indicate:

• Misconfigured geolocation data
• Proxy/relay usage
• Data center placement mismatch

No immediate defensive action required. Standard logging and monitoring recommended.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.