# 15.220.121.167 — IP Intelligence Summary

15.220.121.167 is an IPv4 address operated by Amazon Data Services Argentina (AS16509), geolocated to Ashburn, United States. Its reverse DNS name is ec2-15-220-121-167.compute-1.amazonaws.com. As of November 7, 2026, IPDebrief rates it High Risk (70/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/15.220.121.167
- Last updated: 2026-11-07

## Ownership

- Organization: Amazon Data Services Argentina
- Network name: AMAZON-EZE
- Allocated block: 15.220.120.0/21
- ASN: AS16509 (https://ipdebrief.com/asn/16509)
- Regional registry: ARIN
- Cloud / hosting provider: Amazon Web Services

## Location

- City: Ashburn
- Region: VA
- Country: United States
- Time zone: America/New_York

## Network classification

- Infrastructure type: Unknown
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: High Risk (70/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- ec2-15-220-121-167.compute-1.amazonaws.com
- Forward-confirmed: yes

## Exposed services

- 443/tcp — https

## Analyst narrative

On 2026-10-24 through 2026-11-07, the IP address 15.220.121.167 was observed with a High Risk reputation and a risk score of 70. Ownership records attribute the address to Amazon Data Services Argentina (AS16509, 15.220.120.0/21), while geolocation data places the host in Ashburn, VA, US. The system operated as a Web Server on port 443/HTTPS using Nginx, with a TLS certificate subject of \`lms-aws-us-east-1-bue-1a.roblox.com\`.

Threat indicators flagged a high likelihood of association with campaign infrastructure, correlating with ten other IPs and certificate subjects, alongside one DNSBL listing. Despite zero reported incidents and an active attacker status of false, the intelligence profile recommended blocking the address due to a high risk score with strong threat evidence at critical severity. Firewall rules for iptables, nginx, and pf were generated for enforcement.

## Nearby addresses

- 15.220.121.1 (https://ipdebrief.com/15.220.121.1)
- 15.220.121.10 (https://ipdebrief.com/15.220.121.10)
- 15.220.121.157 (https://ipdebrief.com/15.220.121.157)

## Addresses sharing infrastructure

- 15.220.120.131 — Same TLS certificate (https://ipdebrief.com/15.220.120.131)
- 15.220.120.148 — Same TLS certificate (https://ipdebrief.com/15.220.120.148)
- 15.220.120.195 — Same TLS certificate (https://ipdebrief.com/15.220.120.195)
- 15.220.120.214 — Same TLS certificate (https://ipdebrief.com/15.220.120.214)
- 15.220.123.25 — Same TLS certificate (https://ipdebrief.com/15.220.123.25)
- 15.220.123.47 — Same TLS certificate (https://ipdebrief.com/15.220.123.47)
- 15.220.123.59 — Same TLS certificate (https://ipdebrief.com/15.220.123.59)
- 15.220.123.74 — Same TLS certificate (https://ipdebrief.com/15.220.123.74)
- 15.220.123.141 — Same TLS certificate (https://ipdebrief.com/15.220.123.141)
- 15.220.123.167 — Same TLS certificate (https://ipdebrief.com/15.220.123.167)
- 15.220.123.219 — Same TLS certificate (https://ipdebrief.com/15.220.123.219)
- 15.220.123.228 — Same TLS certificate (https://ipdebrief.com/15.220.123.228)

---

Source: IPDebrief, "15.220.121.167 IP intelligence", https://ipdebrief.com/15.220.121.167, updated 2026-11-07. Assessments are probabilistic.