216.152.252.52📋 Copy

# IP Intelligence Briefing: 216.152.252.52/32

## Executive Summary

IP address 216.152.252.52 is assigned to Beamspeed LLC (ASN 14237) with a moderate risk score of 49. The IP is classified as a known attacker and appears on the blocklist.de blacklist. Despite showing no open ports or active services, the address maintains persistent malicious indicators and belongs to a high-abuse-density subnet.

## Ownership & Infrastructure

• Organization: Beamspeed LLC
• ASN: 14237
• Registration: ARIN
• Location: Yuma, Arizona, US
• Network Block: 216.152.248.0/21
• Hostname: ip-216-152-252-52.wireless.dyn.beamspeed.net

## Threat Indicators

• Risk Score: 49/100 (Moderate Risk)
• Known Attacker: Yes
• DNS Blacklist Count: 1 (blocklist.de)
• Tor Exit Node: No
• Spam Source: No
• Abuse Confidence: Listed in threat feeds with confirmed malicious activity

## Network Neighborhood Analysis

The /24 subnet (216.152.252.0/24) exhibits significant abuse characteristics:

• Abuse Density: 1.0 (High Abuse Classification)
• Active Siblings: 139 out of 256 total IPs
• Threat Siblings: 256 out of 256 (100%)
• Risk Distribution: 88 medium-risk, 12 low-risk, 0 high-risk neighbors
• Inherited Risk Score: 40

The neighborhood demonstrates pervasive abuse activity, with every IP in the subnet flagged as a threat indicator. This suggests compromised infrastructure or coordinated malicious activity across the network block.

## Historical Observations

Analysis of 44 observation records indicates:

• Recent activity shows minimal signal strength
• No persistent malicious behavior pattern detected
• Threat observation count: 1
• Ownership changes: 0
• The IP appears intermittently active with sporadic threat signals

## Technical Classification

• Infrastructure Type: No active services detected
• Connection Type: Firewalled / No Services
• Mobile Carrier: No
• CDN/Provider: No
• Cloud Infrastructure: No
• DNS Resolution: Forward confirmed with 1 PTR record

## Recommended Actions

Based on the risk profile, the following actions are recommended:

Primary Recommendation: Block or rate-limit this IP at the network edge due to suspicious activity indicators.

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 216.152.252.52 -j DROP

# nftables

nft add rule inet filter input ip saddr 216.152.252.52 drop

# AWS WAF

{

"Addresses": ["216.152.252.52/32"],

"Description": "IPDebrief risk 49"

}

```

Additional Considerations:

• Monitor for lateral movement to related IPs in the 216.152.252.0/24 subnet
• Review firewall logs for connection attempts from this IP
• Consider subnet-level blocking if threat persistence increases

---

*Report generated from IPDebrief intelligence platform. All data sourced from automated threat intelligence feeds.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.