216.152.252.87📋 Copy

# IP Intelligence Briefing: 216.152.252.87/32

Classification: Moderate Risk – Known Attacker Activity

Date: 2026-06-24

Risk Score: 49/100

## Executive Summary

IP 216.152.252.87 is registered to Beamspeed LLC (ASN 14237) and is flagged as a known attacker with one active blacklist listing. The IP is associated with the 216.152.252.0/24 subnet, which exhibits high abuse density. Recommended action: Block or rate-limit at network edge.

## Ownership & Network Context

• Organization: Beamspeed LLC
• ASN: 14237 (Beamspeed LLC)
• BGP Prefix: 216.152.248.0/21
• Location: Yuma, Arizona, US (geolocation consensus confirmed)
• DNS Host: ip-216-152-252-87.wireless.dyn.beamspeed.net (forward/reverse confirmed)
• Email Auth: SPF and DMARC records present

## Threat Indicators

• Known Attacker: YES
• Blacklist Status: Listed on blocklist.de
• Blacklist Count: 1
• Tor Exit/Proxy/VPN: No
• Hosting/Cloud: No (classified as Firewalled / No Services)
• Abuse Confidence: Elevated based on known attacker flag

## Network Neighborhood Assessment

The /24 subnet (216.152.252.0/24) shows elevated abuse characteristics:

• Subnet Classification: High abuse
• Active Siblings: 139 out of 256 total IPs
• Abuse Density: 1.0
• Risk Distribution: 58 medium-risk, 42 low-risk, 0 high-risk neighbors

This suggests the subnet may be underutilized or experiencing elevated activity patterns.

## Historical Signal Analysis

46 observations recorded. Recent signal pattern shows:

• High-severity blacklist listing detected at 17:01 UTC (confidence 0.85)
• Multiple minimal-risk observations throughout the day (confidence 0.30)
• Threat observation count: 1
• Persistent malicious activity: No

## Recommended Security Actions

Action: Block or rate-limit at network edge

Severity: High

Reason: Suspicious activity indicators present

Firewall Rules (Recommended)

• iptables: `iptables -A INPUT -s 216.152.252.87 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 216.152.252.87 drop`
• nginx: `deny 216.152.252.87;`
• pfSense: `216.152.252.87/32`
• Cloudflare WAF: Block IP with expression `ip.src eq 216.152.252.87`
• AWS WAF: Apply rule to `216.152.252.87/32`

## Intelligence Assessment

The IP demonstrates attacker-related behavior with active blacklist presence. While no open ports were detected, the known attacker classification and blacklist listing warrant defensive blocking. The subnet context (high abuse density) supports the risk profile. Monitor for correlation with other Beamspeed LLC infrastructure or related malicious campaigns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.