3.87.116.130📋 Copy

# IP Intelligence Briefing: 3.87.116.130/32

Date: [Current Date]

Target: 3.87.116.130

Classification: Cloud Infrastructure / AWS EC2

Risk Level: Moderate Risk (Score: 50)

---

## EXECUTIVE SUMMARY

IP 3.87.116.130 is an Amazon Web Services EC2 instance located in Northern Virginia (Ashburn, VA). The address belongs to ASN 14618 (AMAZON-IAD) within the 3.80.0.0/12 CIDR block. While classified as moderate risk with a score of 50, the IP exhibits cloud infrastructure characteristics with no open services and a clean neighborhood profile. Recent monitoring indicates the IP has been listed on 8 threat intelligence feeds with 1 active high-severity listing as of July 23, 2026.

---

## OWNERSHIP & GEOLOCATION

---

## INFRASTRUCTURE ANALYSIS

• Service Provider: Amazon Web Services
• Infrastructure Type: Cloud (EC2 Instance)
• Connection Type: Standard Cloud Infrastructure
• Network Role: Firewalled / No Services Exposed
• Open Ports: None detected
• TLS Certificate: Not exposed
• HTTP Title: Not exposed
• DNS Resolution: ec2-3-87-116-130.compute-1.amazonaws.com
• Forward Resolution Count: 1
• DNSSEC Valid: Yes

---

## THREAT INDICATORS

• Reputation: Moderate Risk
• Blacklist Count: 0 (current scan)
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Abuse Confidence Score: Not available

Threat Feed Observations

• DNSBL Listings: 2 out of 8 total lists
• Operator Score: 0.2609 (Basic classification)
• Route Stability: Unstable (isRouteStable: false)
• ISP Classification: Basic operator score

---

## OBSERVATION HISTORY

Total Observations: 21 signals tracked

Recent Activity:

• 2026-07-23 11:04 UTC: Listed on multiple threat feeds with high-severity rating (1 of 8 listings active)
• 2026-07-23 11:03 UTC: ASN/geolocation signals confirm AWS infrastructure (is_cloud: true)
• 2026-07-05 23:48 UTC: Geolocation validation attempts (ICMP blocked - unable to validate)
• Geographic Discrepancy: Observed latitude/longitude shows 6,312.5 km distance from claimed location (ICMP validation blocked)

Temporal Indicators:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Is Persistently Malicious: No
• Threat Observation Count: 0

---

## NETWORK RELATIONSHIPS

Associated Entities (9 total):

• DNS Associations: ec2-3-87-116-130.compute-1.amazonaws.com (multiple instances)
• Network Associations: AMAZON-IAD (multiple instances)

All relationships indicate standard AWS EC2 infrastructure associations with no anomalous connections.

---

## SUBNET NEIGHBORHOOD ANALYSIS

Subnet: 3.87.116.130/24

• Abuse Density: 0 (Clean)
• Classification: Clean
• Inherited Risk: 0
• Total Siblings: 1
• Active Siblings: 0
• Threat Siblings: 0
• High Risk Neighbors: 0
• Medium Risk Neighbors: 0
• Low Risk Neighbors: 0

The /24 subnet shows no malicious activity and contains only the target IP.

---

## RECOMMENDATIONS

1. Allow Traffic: This IP is a legitimate AWS EC2 instance with no open services. Allow standard AWS traffic patterns.

2. Monitor DNSBL Listings: Investigate the 2 DNSBL listings to understand the source of negative reputation signals.

3. Cloud Context: Treat as cloud infrastructure; do not block based on IP alone.

4. Neighborhood Clearance: No malicious neighbors detected in the /24 subnet.

5. Action Score: Low priority — no immediate blocking required.

---

## CONCLUSION

IP 3.87.116.130 is a standard AWS cloud infrastructure address with moderate risk classification primarily due to DNSBL associations rather than active malicious behavior. The IP has no open services, operates within a clean subnet, and shows no evidence of persistent malicious activity. SOC analysts should classify this as cloud infrastructure with low threat likelihood. No firewall blocking recommended based on current intelligence.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.