216.151.137.157📋 Copy

# INTELLIGENCE BRIEFING: 216.151.137.157/32

Classification: Moderate Risk | Date: 2026-06-24 | Analyst: SOC Intelligence

## EXECUTIVE SUMMARY

IP address 216.151.137.157 is assigned to Cisco Webex LLC (ASN 13445) and is geolocated to New York, US. The IP maintains a moderate risk score of 40 with no active open services detected. While the individual IP shows no direct threat indicators, the subnet 216.151.137.0/24 exhibits elevated abuse density, requiring contextual monitoring.

## OWNERSHIP AND INFRASTRUCTURE

• Organization: Cisco Webex LLC
• ASN: 13445
• Geolocation: New York, NY, US
• Control Plane Origin: 216.151.128.0/20
• Network Classification: Firewalled / No Services
• Service Purpose: No detected services, no open ports

## THREAT ASSESSMENT

• Overall Risk Score: 40 (Moderate)
• DNSBL Status: Listed on 1 of 8 blacklist sources
• Known Attacker: No
• Spam Source: No
• Tor Exit: No
• Abuse Confidence Score: Not elevated
• Threat Persistence: 0 days observed

## NETWORK CONTEXT

• Subnet: 216.151.137.0/24
• Abuse Density: 0.6289 (High)
• Total Siblings: 256
• Active Siblings: 116
• Threat Siblings: 161
• Risk Distribution: 0 High, 51 Medium, 49 Low (neighbor analysis)

## OBSERVATION HISTORY

41 total observations recorded. Recent signal analysis (2026-06-23 to 2026-06-24) shows consistent minimal risk labeling with 0 raw operator scores. No escalating threat pattern observed across the observation window.

## RELATIONSHIP ANALYSIS

142 relationship entities identified, including multiple same-network associations (CS-1711). No certificate or hostname relationships detected.

## RECOMMENDED ACTIONS

1. Allow with Logging: No blocking recommended; IP is registered to legitimate enterprise provider (Cisco Webex LLC)

2. Monitor Subnet Context: Implement enhanced logging for traffic from 216.151.137.0/24 subnet due to elevated abuse density

3. Baseline Behavior: Establish traffic baseline for future anomaly detection

4. No Firewall Rules Required: No actionable block rules generated based on current risk profile

## SOC INTELLIGENCE

This IP represents a legitimate enterprise infrastructure address with no active malicious indicators. The moderate risk classification is primarily driven by DNSBL listing and high subnet abuse density rather than direct threat attribution. SOC teams should monitor for behavioral anomalies rather than implementing blocking measures.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.