170.64.172.28📋 Copy

# IP Intelligence Briefing: 170.64.172.28

Classification: Cloud Compute Infrastructure (DigitalOcean)

Risk Score: 25 (Low Risk)

Date of Analysis: Current

## Executive Summary

IP address 170.64.172.28 belongs to DigitalOcean, LLC (ASN 14061), a cloud infrastructure provider based in Sydney, Australia. The asset operates as a cloud compute node with standard web and SSH services. No active threat indicators or malicious activity have been detected. The IP presents a low-risk profile suitable for standard monitoring procedures.

## Technical Profile

Ownership & Network:

• Organization: DigitalOcean, LLC
• ASN: 14061
• BGP Prefix: 170.64.128.0/18
• Network Block: 170.64.172.28/24

Geolocation:

• Country: Australia (AU)
• Region: NSW
• City: Sydney
• Geolocation Confidence: Moderate (1 source)
• Validation Status: RTT measurement anomaly detected (220ms observed vs. 330.7ms minimum for 16,533km distance)

Infrastructure:

• Infrastructure Type: Cloud Compute
• Service: Multi-Service Host
• Open Ports: 80/TCP (HTTP), 22/TCP (SSH)
• Server Banner: nginx/1.24.0 (Ubuntu)
• HTTP Status Code: 403 (Forbidden)

## Threat Intelligence

Threat Indicators:

• Blacklist Count: 0
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Reputation Sources: None identified
• Abuse Confidence Score: Not applicable

DNS Reputation:

• DNSBL Listed: 1 of 8 total lists
• Email Authentication: SPF not configured, DMARC not configured

Temporal Analysis:

• Threat Observation Count: 1
• Is Persistently Malicious: No
• Threat Persistence Days: 0
• Ownership Changes: 0

## Neighborhood Analysis

Subnet: 170.64.172.28/24

• Abuse Density: 0
• Classification: Mostly Clean
• Active Siblings: 1
• Threat Siblings: 1
• Inherited Risk: 2

## Relationship Graph

The IP maintains relationships with 27 network entities, all identified as part of the DIGITALOCEAN-170-64-128-0 network block. No external organizational or certificate relationships identified.

## Observation History

Signal Count: 21 observations

Recent Activity:

• Server fingerprinting confirmed: nginx/1.24.0, HTTP/1.1
• Response time: ~450ms TTFB
• Geographic consistency: Persistent RTT validation anomalies
• Operator Score: 0.1304 (Minimal)

## Recommended Actions

Based on the low-risk profile and absence of threat indicators, no immediate blocking or firewall rules are required. Standard monitoring practices are sufficient.

Recommended Monitoring:

• Continue passive observation of DNS and geolocation signals
• Monitor for any changes in threat indicators or blacklist status
• No immediate defensive action required

---

Conclusion: 170.64.172.28 represents standard cloud infrastructure with no evidence of malicious activity. The IP should be treated as a benign cloud compute resource.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.