104.152.52.119📋 Copy

IP Intelligence Briefing: 104.152.52.119

Date: 2026-06-17

---

**1. Core Profile**

• Risk Score: 55/100 (Moderate Risk)
• Ownership: Rethem Hosting LLC (AS14987)
• Geolocation: Chicago, IL, US (latitude 39.83, longitude -98.58)
• Network Role: Colocation Hosting (no open ports, no services detected)
• DNS: PTR hostname `internettl.org` (SPF validated, no DMARC)
• Threat Indicators: No known malicious activity, no blacklist entries.

---

**2. Observation History**

• Recent Geolocation (June 17, 2026): Confirmed in the US with 35% confidence.
• Scanning Activity (June 2, 2026): Port scan detected, but no open ports found.
• Network Stability: BGP route instability (routeChanges30d: 0, isRouteStable: false).

---

**3. Relationships & Context**

• Network Affiliation: Part of Rethem Hosting’s subnet (104.152.52.0/22).
• DNS Associations: Linked to `internettl.org` (PTR record).
• Neighbor Risk: Subnet abuse density 24.59% (40 medium-risk siblings, 31 low-risk).

---

**4. Recommended Actions**

• Monitoring: Increase logging verbosity for this IP and review recent activity.
• Firewall Rules:

- iptables: `iptables -A INPUT -s 104.152.52.119 -j DROP`

- Cloudflare WAF: Block IP with rule: `ip.src eq 104.152.52.119`

- AWS WAF: Add `104.152.52.119/32` to a new rule.

• Investigation: Validate DNS associations (e.g., `internettl.org`) for potential spoofing or misconfigurations.

---

**5. Summary**

This IP is associated with a hosting provider and shows no direct malicious indicators. However, its moderate risk score and network stability issues warrant closer monitoring. The subnet contains mixed-risk siblings, so contextual analysis of neighboring IPs is advised. Implement firewall restrictions to mitigate potential unknown risks.

Threat Level: Moderate (monitor and restrict).

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.