167.99.142.36📋 Copy

# IP Intelligence Briefing: 167.99.142.36/32

## Executive Summary

IP 167.99.142.36 is a low-risk cloud hosting endpoint operated by DigitalOcean, LLC, located in Frankfurt am Main, Germany. The asset presents minimal immediate threat but warrants monitoring due to hostname associations with cyberresilience.io and one DNSBL listing.

## Asset Profile

Ownership & Infrastructure

• Organization: DigitalOcean, LLC (ASN: 14061)
• Infrastructure Type: CloudCompute (hosting infrastructure)
• Location: Frankfurt am Main, Germany (DE)
• CIDR Block: 167.99.128.0/20
• BGP Prefix: 167.99.128.0/20

Risk Assessment

• Overall Risk Score: 25 (Low Risk)
• Provider Score: 0
• Authority Score: 0
• Reputation: Low Risk
• Route Stability: False
• DNSSEC: Valid

## Network Services & DNS

Open Ports & Services

• Port 80/TCP: HTTP
• Port 443/TCP: HTTPS
• TLS Configuration: TLS 1.3, Cipher: TLS_AES_256_GCM_SHA384

DNS Resolution

• PTR Record: portscanner-fra1-02.prod.cyberresilience.io
• Forward Resolutions: broadcast1.provisionalweb.info
• Associated Domain: omniconnectivity.online
• TLS Certificate: Issued by Let's Encrypt, Subject: *.train.fr2301vk8s001.omniconnectivity.online
• Email Authentication: SPF configured, DMARC absent

## Threat Indicators

Current Status

• Blacklist Count: 0
• DNSBL Listed: 1 of 8 lists
• Tor Exit Node: False
• Known Attacker: False
• Spam Source: False
• Active Threats: None identified

Threat Persistence

• Observation Count: 1
• Persistence Days: 0
• Campaign Likelihood: None

## Historical Observations (26 total)

Recent signal history indicates:

• 2026-06-28: Cloud computing infrastructure classification confirmed (DigitalOcean, is_hosting: true)
• 2026-06-20: HTTPS connection attempts recorded; TLS certificate scanning activity; geolocation confirmed in Frankfurt am Main with 50+ threat pulse matches in historical feeds

## Subnet Neighborhood Analysis

• Subnet: 167.99.142.36/24
• Abuse Density: 1 (mostly_clean classification)
• Total Siblings: 1
• Active Siblings: 1
• Threat Siblings: 1
• Inherited Risk: 2

## Relationships Graph (54 total)

• DNS associations to portscanner-fra1-02.prod.cyberresilience.io (multiple entries)
• Network associations to DIGITALOCEAN-167-99-0-0
• Same network relationships within DigitalOcean infrastructure

## Recommended Actions

Based on the low-risk profile and minimal threat indicators, the following actions are recommended:

1. Monitor: Continue monitoring DNSBL status and threat feed updates

2. Allow: Permissive firewall rules acceptable for cloud hosting infrastructure

3. No Immediate Block: No active threats or attack patterns identified

4. Correlation: Investigate relationship to portscanner-fra1-02.prod.cyberresilience.io hostname for potential coordinated infrastructure

## Conclusion

This IP represents a legitimate cloud hosting asset with minimal risk exposure. The DNSBL listing and hostname associations warrant periodic review but do not indicate immediate threat. Standard monitoring protocols are sufficient for this asset.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.