# IP Intelligence Briefing: 51.15.216.52/32
Classification: Low Risk | Date: Current Intelligence Cycle
Prepared For: SOC Operations Team
---
## Executive Summary
IP address 51.15.216.52 operates as a Scaleway cloud infrastructure endpoint with a low-risk profile (score: 25). Analysis indicates legitimate commercial hosting activity serving Apple Inc. software distribution services. No active threat indicators detected. No immediate blocking recommended.
---
## Infrastructure Profile
| Attribute | Value |
|---|---|
| **IP Address** | 51.15.216.52/32 |
| **ASN** | 12876 |
| **Organization** | Mickael Marchand (SCALEWAY) |
| **Country** | FR (France) |
| **City** | Paris, Île-de-France |
| **Infrastructure Type** | Cloud Compute |
| **Classification** | Hosting/Web Server |
| **Reputation** | Low Risk |
Network Assignment:
- CIDR Block: 51.15.0.0/16
- RIR: ARIN
- Provider: Scaleway
---
## Service & Protocol Analysis
| Service | Status | Details |
|---|---|---|
| **HTTPS (443/TCP)** | Active | AkamaiGHost server banner |
| **TLS Certificate** | Valid | Issued by Apple Public EV Server RSA CA 1 - G1 |
| **Certificate Subject** | swdist.apple.com | Apple Inc., Cupertino, CA |
| **Associated Domains** | swcatalog.apple.com, swcdn.apple.com, swdist.apple.com, swscan.apple.com | Apple software distribution |
| **DNS PTR** | 52-216-15-51.instances.scw.cloud | Scaleway cloud hostname |
---
## Threat Indicators Assessment
| Indicator | Status |
|---|---|
| Tor Exit Node | No |
| Known Attacker | No |
| Spam Source | No |
| Blacklist Count | 0 |
| Abuse Confidence Score | N/A |
| Known Campaigns | None |
| Threat Feeds | None |
| DNSBL Listed | 1 of 8 total lists |
| Is Persistently Malicious | No |
---
## Subnet Neighborhood Analysis
Scope: 51.15.216.52/24
- Abuse Density: 0 (Clean)
- Total Siblings: 1
- Active Siblings: 0
- Threat Siblings: 0
- Subnet Classification: Clean
- Inherited Risk: 0
No adjacent threat activity detected within the /24 subnet.
---
## Relationship Graph
Total Relationships: 16
- Network Associations: Multiple Scaleway network references
- DNS Associations: 8 hostname associations (52-216-15-51.instances.scw.cloud)
- No External Threat Links detected
---
## Historical Observation Summary
Observation Count: 25 signals
Recent Activity (2026-08-05):
- Cloud provider classification consistent (Scaleway)
- Geolocation inference: Paris, France (confidence: 0.28)
- Certificate data: Apple Inc. (confidence: 0.65)
- HTTP headers: AkamaiGHost, 400 status code observed
- Operator score: Minimal (0.1304)
Temporal Analysis:
- Ownership changes: 0
- Threat persistence: 0 days
- Threat observation count: 0
- Is persistently malicious: False
---
## Control Plane Data
| Metric | Value |
|---|---|
| Origin ASN | 12876 |
| BGP Prefix | 51.15.0.0/16 |
| Route Stability | False |
| RPKI State | N/A |
| DNSSEC Valid | Yes |
| Has CAA | No |
| Operator Score | 0.1304 (Minimal) |
---
## Recommended Actions
Security Posture: Monitor but no immediate action required.
Firewall Rules: None recommended (low-risk classification)
Monitoring Guidance:
- Continue standard logging for HTTPS traffic
- No specific blocklist entries warranted
- IP appears to serve legitimate Apple software distribution content
- No correlation with known malicious campaigns
---
## Conclusion
IP 51.15.216.52 represents a legitimate Scaleway cloud infrastructure endpoint hosting Apple software distribution services. The IP maintains a clean reputation profile with no threat indicators, no malicious neighborhood activity, and consistent historical observations. This IP should be treated as benign infrastructure.
Classification: LOW RISK - No Action Required
Next Review: Standard periodic intelligence cycle
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
๐ข Ownership & Registration
| Organization | Mickael Marchand |
| ASN | AS12876 |
| Network Name | SCALEWAY |
| CIDR Block | 51.15.0.0/16 |
| RIR | ARIN |
| Country | FR |
| Abuse Contact | Available via RDAP |
๐ DNS Intelligence
| PTR | 52-216-15-51.instances.scw.cloud |
| Forward Confirmed | No โ PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | 52-216-15-51.instances.scw.cloud |
๐ DNS Hygiene
| Hygiene Score | 60% (Good) |
| SPF | 2/2 domains |
| DMARC | 1/2 domains |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
| Domains Checked | 2 domains |
โ๏ธ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Web Server |
| Network Tier | Hosting โ Infrastructure provider without advanced routing |
๐ Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 443 | https | tcp | โ |
| Closed Ports | 22, 25, 80, 3389, 8080, 8443 (1 open / 7 scanned) | ||
| Server | AkamaiGHost |
| HTTP Title | โ |
๐ TLS Certificate
| SANs | swcatalog.apple.comswcdn.apple.comswdist.apple.comswscan.apple.com |
| Valid From | 2026-03-18T17:36:34+00:00 |
| Valid Until | 2026-09-24T19:09:47+00:00 |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_256_GCM_SHA384 |
| Signature Algorithm | sha256RSA |
| Validity Period | 190 days |
| Serial Number | 0841C3BCFFE329034F569899FBBD7BD3 |
| Thumbprint | 75B59A0ACC77131BDAA8900D16DDAD955EA8D911 |
๐ฏ Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 35% | 2 | 3 |
| routing | 13% | 1 | 1 |
| services | 30% | 2 | 3 |
| ownership | 27% | 2 | 3 |
| reputation | 17% | 1 | 2 |
| geolocation | 30% | 2 | 3 |
| Overall | 25% | 10 | 15 |
| Data Coherence | Mixed Signals (68%) โ 2 contradiction(s) |
| Attribution | Low (35%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
โ TLS certificate claims US but primary geo says FR
๐ Observation Timeline ๐ Live
| First Seen | 2026-07-22 19:33:18 UTC |
| Last Seen | 2026-08-12 17:16:48 UTC |
| Profile Built | 2026-08-12 17:31:45 UTC |
| Data Freshness | Live |
| Signal Types | 25 |
| Total Observations | 27 |
Full dossier details are available via our API.