209.38.248.17
IP Intelligence Briefing: 209.38.248.17
*Generated from IPDebrief analysis*
---
**1. Core Profile**
- Risk Assessment: Moderate Risk (Risk Score: 50). No active threat indicators detected.
- Ownership: Owned by DigitalOcean, LLC (ASN 14061, netname DO-13).
- Geolocation: Registered to Frankfurt am Main, Germany (US region in geolocation data).
- Network Role: CloudCompute infrastructure (DigitalOcean droplet).
- Services:
- Open ports: HTTP (80), SSH (22).
- SSH banner: `SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u7`.
- Web server: `lighttpd/1.4.59`.
---
**2. Threat & Security Observations**
- Threat History:
- Listed in 8 threat feeds (June 2026) with high severity.
- DNS association with leakix.org (linked to data leak sources).
- DNS:
- PTR hostname: `c1fe727412.scan.leakix.org`.
- SPF/DKIM records present, but no email-related risks detected.
- Network Behavior:
- Subnet 209.38.248.17/24 has abuse density 0.5 (moderate risk).
- One neighboring IP (209.38.248.238) with risk score 25.
---
**3. Relationships & Context**
- Network Connections:
- Linked to DO-13 (DigitalOcean network).
- DNS ties to leakix.org, suggesting potential exposure to compromised domains.
- Subnet Analysis:
- Subnet 209.38.248.0/24 contains 1 active IP (this one) and 1 threat sibling.
---
**4. Recommendations**
- Monitor DNS: Investigate the link to leakix.org for potential data exfiltration or command-and-control activity.
- Secure SSH: Ensure SSH access is restricted to authorized users and monitor for brute-force attempts.
- Subnet Monitoring: Track 209.38.248.238 for abnormal behavior, as it resides in the same subnet.
- Threat Feed Check: Verify if the IP’s historical listings in threat feeds are resolved or persistent.
---
Conclusion: This IP is a legitimate DigitalOcean droplet with no active malicious activity detected. However, its association with leakix.org and moderate subnet risk warrant closer monitoring. SOC teams should focus on SSH security and subnet-level threat detection.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | DigitalOcean, LLC |
| ASN | AS14061 |
| Network Name | DO-13 |
| CIDR Block | 209.38.0.0/16 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | c1fe727412.scan.leakix.org |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | c1fe727412.scan.leakix.org |
🔐 DNS Hygiene
| Hygiene Score | 80% (Excellent) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Multi-Service Host |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 22 | ssh | tcp | |
| Closed Ports | 25, 443, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | lighttpd/1.4.59 |
| HTTP Title | — |
| SSH Version | SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u7 |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 33% | 2 | 4 |
| routing | 13% | 1 | 1 |
| services | 30% | 2 | 3 |
| ownership | 27% | 2 | 3 |
| reputation | 13% | 1 | 2 |
| geolocation | 30% | 2 | 4 |
| Overall | 24% | 10 | 17 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (70%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-28 12:25:26 UTC |
| Last Seen | 2026-06-29 05:26:37 UTC |
| Profile Built | 2026-06-29 05:32:34 UTC |
| Data Freshness | Live |
| Signal Types | 23 |
| Total Observations | 24 |
Full dossier details are available via our API.