152.32.211.187📋 Copy

# IP INTELLIGENCE BRIEFING: 152.32.211.187/32

Classification: MODERATE RISK (65/100)

Date: 2026-07-29

Prepared: IPDebrief Intelligence Analysis

---

## EXECUTIVE SUMMARY

IP 152.32.211.187 is a Hong Kong-based infrastructure address under UCLOUD INFORMATION TECHNOLOGY HK LIMITED (ASN 135377). The IP presents moderate risk (65/100) with elevated threat indicators including DNSBL listings, but lacks confirmed malicious activity indicators. The IP is currently firewalled with no open services detected.

---

## OWNERSHIP & NETWORK ATTRIBUTES

---

## THREAT PROFILE

Risk Score: 65/100 (MODERATE)

Threat Indicators:

• DNSBL Status: Listed on 3 of 8 threat lists (MAX SEVERITY: HIGH)
• Known Attacker: NO
• Tor Exit Node: NO
• Spam Source: NO
• Blacklist Count: 0

Network Role:

• Classification: Firewalled / No Services
• Open Ports: None detected
• Services: None active
• TLS Certificates: None

---

## SUBNET CONTEXT ANALYSIS

Subnet: 152.32.211.0/24

• Abuse Density: 0 (CLEAN)
• Classification: Clean
• Active Siblings: 3 of 6 total

Neighbor Risk Distribution:

• High Risk: 0
• Medium Risk: 3 (152.32.211.69, 152.32.211.139, 152.32.211.153)
• Low Risk: 2 (152.32.211.20, 152.32.211.167)

Assessment: The IP operates within a generally clean subnet with minimal abuse activity.

---

## OBSERVATION HISTORY

Total Signals: 14 observations

Latest Activity: 2026-07-29

Key Observations:

• Ownership: Stable (0 changes detected)
• Geolocation: Consistent HK placement with 52% confidence
• DNSSEC: Validated
• Malicious Activity: No persistent malicious behavior detected
• Threat Persistence: 0 days

---

## RELATIONSHIP MAPPING

Connected Entities:

• UCLOUD-HK network (3 relationships)
• No certificate or hostname associations

---

## RECOMMENDED ACTIONS

Priority: HIGH — Elevated risk score warrants monitoring

Monitoring:

• Increase logging verbosity for this IP
• Review recent activity patterns

Firewall Rules:

```

# iptables

iptables -A INPUT -s 152.32.211.187 -j DROP

# nftables

nft add rule inet filter input ip saddr 152.32.211.187 drop

# nginx

deny 152.32.211.187;

```

WAF Integration:

• Cloudflare WAF: Block IP with expression `ip.src eq 152.32.211.187`
• AWS WAF: Add to rule set with CIDR `152.32.211.187/32`

---

## INTELLIGENCE ASSESSMENT

This IP address represents moderate risk infrastructure with elevated DNSBL presence. While no direct attack indicators exist, the risk score warrants defensive measures. The subnet shows low abuse density, suggesting this IP may be involved in non-malicious traffic but still poses elevated risk. Recommended action is to implement blocking with logging for forensic review.

Confidence Level: HIGH — Based on comprehensive threat intelligence correlation

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.