168.144.118.176📋 Copy

# IP INTELLIGENCE BRIEFING: 168.144.118.176/32

## Executive Summary

Intellect analysis of IP 168.144.118.176 indicates a Low Risk cloud infrastructure endpoint hosted on DigitalOcean. The IP exhibits no active threat indicators, maintains stable operational characteristics, and resides within a network segment with minimal abuse density. No immediate security action is required.

---

## Infrastructure Profile

---

## Network Services & Configuration

The endpoint operates standard web infrastructure services:

• Port 80/TCP: HTTP service active
• Port 443/TCP: HTTPS service active
• Port 22/TCP: SSH access enabled (OpenSSH_9.6p1 Ubuntu-3ubuntu13.16)
• TLS Certificate: Let's Encrypt (CN=E8, O=Let's Encrypt, C=US)
• Application: nginx/1.24.0 on Ubuntu
• DNS: SPF record present; DMARC not configured

---

## Threat Assessment

Current Threat Status: Clean

Abuse Confidence: Insufficient data to generate score

---

## Neighborhood Analysis (168.144.118.0/24)

The IP resides in a subnet with moderate abuse density (33.33%).

Subnet Classification: Mostly clean with 1 active threat sibling identified

---

## Observation History (26 observations)

Temporal analysis reveals stable operational characteristics with no significant changes:

• Infrastructure: Consistently identified as DigitalOcean cloud infrastructure
• ASN: Maintained ASN 14061 throughout observation period
• BGP Route: Stable prefix 168.144.112.0/20 via origin ASN 14061
• HTTP/HTTPS: Fingerprinted as nginx/1.24.0 with Next.js application
• No Malicious Evolution: No emergence of threat indicators over time

---

## Control Plane & Routing

• Origin ASN: 14061 (DigitalOcean)
• AS Path: 6939 → 6453 → 4755 → 14061
• RPKI State: Not verified
• Route Stability: Stable (no route changes in 30 days)
• IRR Consistency: Not verified
• Delegation Age: 5,011 days

---

## SOC Analyst Recommendations

Priority: LOW

1. No Blocking Required: The IP exhibits no malicious behavior and maintains low-risk profile

2. Monitor SSH Access: Port 22 is open; verify legitimate business need for SSH access to this endpoint

3. DMARC Gap: Consider implementing DMARC policy for the associated domain (testappnext.youthbeat.in)

4. DNSBL Review: Investigate the single DNSBL listing to determine cause and remediate if necessary

5. Neighborhood Awareness: Two sibling IPs (168.144.118.119, 168.144.118.225) share similar risk scores; maintain situational awareness

Classification: Standard Cloud Infrastructure - No Threat

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.