3.110.156.252📋 Copy

# IP Intelligence Briefing: 3.110.156.252/32

## Executive Summary

IP address 3.110.156.252 is a low-risk infrastructure endpoint belonging to Amazon Web Services (AWS) Mumbai region (ap-south-1). Current risk score of 25 indicates minimal threat posture. No active malicious indicators detected. Recommended action: Monitor but no immediate blocking required.

---

## Infrastructure Profile

---

## Threat Assessment

Current Threat Status: Clean

• Threat Indicators: None detected
• Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Matches: None

Network Role:

• Infrastructure Type: Cloud Compute
• Hosting Status: Active
• Connection Type: Firewalled (No services exposed)
• Mobile/Residential: No
• Proxy/VPN: No

---

## Historical Analysis

Observation history reveals 25 signals collected over the monitoring period:

• Recent Activity: 2026-06-18 observations show 1 of 8 total DNS blacklist listings with high severity rating
• ASN Consistency: Routing data consistently identifies as AMAZON-02 (ASN 16509)
• Geolocation: Persistent assignment to India region
• Threat Persistence: 0 threat observation days; not classified as persistently malicious

Temporal Indicators:

• Ownership stability: No changes recorded
• Threat observation count: 1
• Is persistently malicious: No

---

## Relationship Graph

65 relationships identified, primarily:

• Network Associations: Multiple "Same Network" links to AMAZON-BOM network
• DNS Associations: ec2-3-110-156-252.ap-south-1.compute.amazonaws.com
• Control Plane: BGP origin from ASN 16509 with stable routing

---

## Neighborhood Analysis

Subnet: 3.110.156.252/24

• Abuse Density: 0 (Classified as "mostly_clean")
• Total Siblings: 1
• Active Siblings: 1
• Threat Siblings: 1
• Risk Distribution: All neighbors classified as low risk
• Inherited Risk: 2

Neighborhood analysis indicates this IP operates in a relatively clean AWS subnet environment.

---

## Recommended Actions

Current Risk Profile: 25/100

Firewall Rules: None recommended

SOC Guidance:

1. Monitor: Maintain observation of this IP for threat intelligence correlation

2. Allow: Permissive rules appropriate for legitimate AWS infrastructure

3. No Blocking: Current indicators support continued network access

4. Context: Typical AWS cloud workload endpoint in Mumbai region

---

## Intelligence Notes

This IP represents standard AWS cloud infrastructure. Historical blacklist activity appears sporadic and does not indicate persistent malicious use. The firewalled nature of the endpoint suggests proper security configuration. SOC analysts should treat as legitimate cloud infrastructure unless new threat indicators emerge.

Confidence Level: High (Multiple data sources corroborating AWS ownership and clean threat posture)

---

*Intelligence generated from IPDebrief threat intelligence platform. All data sourced from verified signal observations.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.