64.226.120.21📋 Copy

# Intelligence Briefing: 64.226.120.21

Classification: Moderate Risk Infrastructure Node

Analysis Date: Current

Status: Active Cloud Host

## Executive Summary

IP address 64.226.120.21 is a DigitalOcean cloud infrastructure host located in Frankfurt am Main, Germany. The address presents a moderate risk profile (score: 40) with evidence of DNSBL listings (2/8 lists) but operates within a clean subnet environment with zero abuse density.

## Technical Profile

Ownership & Registration:

• Organization: DigitalOcean, LLC (ASN 14061)
• Location: Frankfurt am Main, Hesse, Germany
• Infrastructure Type: Cloud Computing / Web Server
• CIDR Block: 64.226.112.0/20

Network Services:

• Open Ports: 22/SSH, 80/HTTP, 443/HTTPS
• Server Banner: Apache/2.4.58 (Ubuntu)
• TLS Certificate: Let's Encrypt (CN=farmacitrita.al)
• Fingerprint: nginx/1.24.0

DNS Resolution:

• PTR Hostname: farmaricritrita.al
• Forward Resolution: Confirmed
• Email Authentication: SPF and DMARC records absent

## Threat Intelligence

Risk Indicators:

• DNSBL Listings: 2 out of 8 threat feeds (high severity noted)
• Control Plane: Route instability detected (isRouteStable: false)
• Operator Score: 0.2609 (Basic classification)
• No active threat campaigns or known attacker associations

Historical Observations:

• 22 total signal observations recorded
• Recent activity observed as of 2026-06-15
• Cloud infrastructure consistently identified
• No persistent malicious behavior patterns

## Relationship Graph

Associated Entities:

• Primary DNS: farmaricritrita.al (31 relationship entries)
• Network: DIGITALOCEAN-64-226-64-0
• No certificate matches or correlated IPs detected

## Neighborhood Assessment

Subnet Analysis (64.226.120.21/24):

• Abuse Density: 0 (Clean)
• Threat Siblings: 0
• Active Siblings: 1
• Risk Distribution: Evenly distributed (no high/medium risk neighbors)

## SOC Recommendations

Allow/Block Decision: Monitor with logging recommended due to DNSBL listings.

Recommended Actions:

• Block SSH port 22 from untrusted external networks
• Implement rate limiting on HTTP/HTTPS ports
• Add to monitoring dashboard for DNSBL listing correlation
• Verify legitimacy of farmaricritrita.al domain ownership

Firewall Rule Template:

```

# Block SSH from non-trusted sources

iptables -A INPUT -p tcp --dport 22 -s <external_network> -j DROP

# Allow HTTPS with rate limiting

iptables -A INPUT -p tcp --dport 443 -m limit --limit 25/minute -j ACCEPT

# Log and monitor DNSBL hits

iptables -A INPUT -p tcp --dport 80 -j LOG --log-prefix "[DNSBL-MONITOR] "

```

Threat Level: Moderate - Cloud hosting infrastructure with minor reputation issues. No immediate threat indicators requiring emergency response.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.