3.112.199.65📋 Copy

# IP Intelligence Briefing: 3.112.199.65/32

Date: 2026-07-30

Classification: Moderate Risk

## Executive Summary

IP 3.112.199.65 is an Amazon Web Services EC2 instance registered to Amazon Data Services Japan (ASN 16509). The address carries a moderate risk score of 50 and is listed on 2 of 8 DNSBLs. While no active threat indicators were identified, the IP is recommended for blocking based on its risk profile and blacklist presence.

## Network Ownership & Classification

• Owner: Amazon Data Services Japan
• Organization: AMAZON-NRT
• CIDR Block: 3.112.0.0/14
• ASN: 16509
• Infrastructure Type: Amazon Web Services EC2 Instance
• Hostname: ec2-3-112-199-65.ap-northeast-1.compute.amazonaws.com
• Service Purpose: Firewalled / No Services Detected

## Geolocation Analysis

Geolocation data presents conflicting signals:

• Primary consensus: Tokyo, Japan
• Secondary signal: Chicago, US (transit)
• GeoConsensus: False
• Accuracy Radius: 2,500 km
• RIR Registration: ARIN

The discrepancy in geolocation data warrants monitoring but does not indicate malicious intent by itself.

## Threat Assessment

• Risk Score: 50 (Moderate Risk)
• Threat Indicators: None detected
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0 (threat section) / 2 (DNSBL lists)
• Known Campaigns: None
• Campaign Likelihood: Not applicable
• Operator Score: 0.2609 (Basic)

Note: While the threat indicators section shows zero indicators, the control plane data indicates DNSBL listing on 2 of 8 lists, contributing to the moderate risk classification.

## Network Neighborhood Analysis

• Subnet: 3.112.199.65/24
• Abuse Density: 0
• Classification: Clean
• Total Siblings: 1
• Active Siblings: 0
• Threat Siblings: 0

The /24 subnet shows no abuse density and no neighboring threat actors, suggesting this IP operates in isolation within its network segment.

## Relationship Graph

Three relationships identified:

1. DNS Association: ec2-3-112-199-65.ap-northeast-1.compute.amazonaws.com

2. Same Network: AMAZON-NRT

3. DNS Association: ec2-3-112-199-65.ap-northeast-1.compute.amazonaws.com

No additional infrastructure or organizational relationships detected beyond AWS ecosystem.

## Historical Observations

17 observations recorded as of 2026-07-30. Recent signals include:

• Organization identification (Amazon Data Services Japan, confidence 0.90)
• Network geolocation (Tokyo, Japan, confidence 0.95)
• Transit routing observations (Chicago, US)
• Traceroute analysis (29 hops, target not reached)

No persistent malicious behavior observed. Threat persistence days: 0.

## Recommended Security Actions

Immediate Action: Block traffic from this IP address

Firewall Rules

iptables:

```

iptables -A INPUT -s 3.112.199.65 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 3.112.199.65 drop

```

nginx:

```

deny 3.112.199.65;

```

pfSense:

```

3.112.199.65/32

```

Cloudflare WAF:

```json

{

"description": "Block 3.112.199.65 — IPDebrief risk score 50",

"action": "block",

"filter": {

"expression": "ip.src eq 3.112.199.65"

}

}

```

AWS WAF:

```json

{

"Addresses": ["3.112.199.65/32"],

"Description": "IPDebrief risk 50"

}

```

## Intelligence Narrative

This IP address represents a standard AWS EC2 instance without active malicious indicators. The moderate risk score stems primarily from DNSBL listings rather than observed threat activity. The geolocation discrepancy between Tokyo, Japan (primary) and Chicago, US (transit) reflects the complex routing infrastructure of AWS's global network and does not indicate malicious activity.

The /24 subnet shows clean classification with zero abuse density and no sibling threats. No relationships extend beyond the AWS ecosystem, suggesting this is an isolated endpoint.

Recommendation: Block this IP at the perimeter firewall level. The blocking recommendation is based on the moderate risk score and DNSBL presence. If the IP represents legitimate traffic (e.g., your own AWS infrastructure), whitelist based on organizational verification before applying blocking rules.

Monitoring: Continue monitoring for any changes in threat indicators, DNSBL listings, or neighborhood activity.

---

*Intel generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.