# 16.15.252.91 — IP Intelligence Summary

16.15.252.91 is an IPv4 address operated by Amazon.com, Inc. (AS14618), geolocated to Ashburn, United States. As of November 7, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/16.15.252.91
- Last updated: 2026-11-07

## Ownership

- Organization: Amazon.com, Inc.
- Network name: AMAZO-4
- Allocated block: 16.15.0.0/16
- ASN: AS14618 (https://ipdebrief.com/asn/14618)
- Regional registry: ARIN
- Cloud / hosting provider: Amazon Web Services

## Location

- City: Ashburn
- Region: VA
- Country: United States
- Time zone: America/New_York

## Network classification

- Infrastructure type: Unknown
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Exposed services

- 80/tcp — http
- 443/tcp — https
- 8080/tcp — http-alt

## Analyst narrative

**Intelligence Briefing: 16.15.252.91/32**

**Classification:** Low Risk

**Ownership:** Amazon.com, Inc. (AS14618, AMAZO-4)

**Location:** Ashburn, VA, US

The IP address 16.15.252.91 was identified as a commercial infrastructure endpoint associated with Amazon Web Services. Ownership records confirmed the address belongs to the 16.15.0.0/16 netblock registered in Ashburn, Virginia.

**Operational Profile:**

Traffic analysis revealed the endpoint functioned as a web server hosting Amazon S3 services. The server banner returned "AmazonS3," and TLS certificates validated against \`s3.amazonaws.com\`. Active listening ports included 80 (HTTP), 443 (HTTPS), and 8080 (HTTP-alt).

**Threat Indicators:**

The address maintained a Low Risk reputation score of 25. No active malicious indicators, known campaigns, or spam source associations were detected. One DNSBL listing was recorded out of eight total lists checked. Behavioral analysis indicated zero WAF violations or honeypot hits.

**Data Anomalies:**

A contradiction existed between the claimed US geolocation and RTT physics measurements, indicating a 6312km distance versus a 29ms round-trip time. Overall data confidence was rated Very Low.

**Recommendation:**

SOC analysts should monitor the IP address for changes in behavior or reputation. The current threat severity is Low. No immediate blocking is required

## Nearby addresses

- 16.15.252.16 (https://ipdebrief.com/16.15.252.16)
- 16.15.252.38 (https://ipdebrief.com/16.15.252.38)
- 16.15.252.39 (https://ipdebrief.com/16.15.252.39)
- 16.15.252.46 (https://ipdebrief.com/16.15.252.46)
- 16.15.252.50 (https://ipdebrief.com/16.15.252.50)
- 16.15.252.54 (https://ipdebrief.com/16.15.252.54)
- 16.15.252.73 (https://ipdebrief.com/16.15.252.73)
- 16.15.252.82 (https://ipdebrief.com/16.15.252.82)
- 16.15.252.90 (https://ipdebrief.com/16.15.252.90)
- 16.15.252.97 (https://ipdebrief.com/16.15.252.97)
- 16.15.252.105 (https://ipdebrief.com/16.15.252.105)
- 16.15.252.112 (https://ipdebrief.com/16.15.252.112)

---

Source: IPDebrief, "16.15.252.91 IP intelligence", https://ipdebrief.com/16.15.252.91, updated 2026-11-07. Assessments are probabilistic.