206.189.5.249📋 Copy

## IP Intelligence Briefing: 206.189.5.249/32

Executive Summary

IP 206.189.5.249 is a DigitalOcean cloud compute resource assigned to the DIGITALOCEAN-206-189-0-0/16 block. The address presents moderate risk (score: 50) with no active threat indicators. The IP is currently firewalled with no open services detected and no open ports.

Ownership & Infrastructure

• Provider: DigitalOcean, LLC
• ASN: 14061
• CIDR Block: 206.189.0.0/16
• Infrastructure Type: CloudCompute
• Location: Amsterdam, NH, US
• Geolocation Confidence: High (plausible with 2500km radius accuracy)

Network Classification

• Classification: Firewalled / No Services
• Open Ports: None detected
• DNS PTR Record: portscanner-ams3-03.prod.cyberresilience.io
• Forward Resolution: Confirmed to portscanner-ams3-03.prod.cyberresilience.io
• Email Authentication: SPF and DMARC records present
• DNSBL Status: Listed on 2 of 8 threat feeds

Neighborhood Analysis

The /24 subnet (206.189.5.0/24) shows a clean abuse profile:

• Abuse Density: 0
• Subnet Classification: Clean
• Total Siblings: 2 active IPs
• Threat Siblings: 0
• Neighbor IP: 206.189.5.117 (risk score: 25, authority score: 50)

Threat Indicators

• Risk Score: 50 (Moderate)
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Blacklist Count: 0
• Campaign Association: None detected
• Threat Persistence: 0 days observed
• Is Persistently Malicious: No

Relationship Graph

The IP maintains 29 relationships with:

• Network Associations: DIGITALOCEAN-206-189-0-0 (multiple entries)
• DNS Associations: portscanner-ams3-03.prod.cyberresilience.io (hostname)

Observation History

Twenty-two observations recorded since deployment. Recent activity includes:

• Network classification updates (June 21, 2026)
• Geolocation confirmations (US-based)
• Operator scoring assessments (score: 0.3478, label: Basic)
• Banner analysis with no malicious patterns detected

Recommended Security Actions

Despite the moderate risk classification, the IP shows no active threat behavior. However, the following defensive rules are available for implementation:

Firewall Rules:

• iptables: `iptables -A INPUT -s 206.189.5.249 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 206.189.5.249 drop`
• nginx: `deny 206.189.5.249;`

WAF Integration:

• Cloudflare WAF: Block IP with filter expression `ip.src eq 206.189.5.249`
• AWS WAF: Add 206.189.5.249/32 to IP Set for blocking

Intelligence Assessment

This DigitalOcean IP represents low-to-moderate risk with no active malicious indicators. The hostname association with "cyberresilience.io" suggests legitimate infrastructure usage. The DNSBL listings (2 of 8) warrant monitoring but do not indicate confirmed malicious activity. The subnet exhibits clean abuse characteristics with no threat siblings. SOC analysts should treat this as a monitored but not actively threatening IP, with recommendation to block only if correlated with specific incident data.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.