52.11.153.2
# IP Intelligence Briefing: 52.11.153.2/32
Classification: Moderate Risk Infrastructure (AWS Cloud)
Date: 2026-08-12
## Executive Summary
IP 52.11.153.2 is a cloud-hosted web server within Amazon Web Services infrastructure. The IP exhibits moderate risk (score: 50) primarily due to DNSBL listings, though no active threat indicators or campaign activity have been detected. The asset is part of a clean subnet with low abuse density.
## Ownership and Location
| Attribute | Value |
|---|---|
| ASN | 16509 (Amazon Technologies Inc.) |
| Organization | AT-88-Z (Amazon Web Services) |
| Location | Oregon, US (Boardman) |
| CIDR Block | 52.0.0.0/10 |
| Infrastructure Type | CloudCompute (AWS EC2) |
## Network Services
- Open Ports: TCP/443 (HTTPS)
- Server Fingerprint: Citrix-3.2.5.9
- TLS Certificate: Amazon RSA 2048 M04 (Issuer: CN=Amazon RSA 2048 M04)
- DNS Resolution: ec2-52-11-153-2.us-west-2.compute.amazonaws.com
- DNSSEC Status: Valid
## Threat Assessment
- Risk Score: 50/100 (Moderate)
- Blacklist Status: Listed on 2 of 8 DNSBL feeds
- Abuse Confidence: Not applicable (cloud infrastructure)
- Known Threats: None detected
- Campaign Activity: No matching campaigns
- Tor Exit Node: No
- Proxy/VPN: No
## Historical Activity
- Observations: 26 signal observations recorded
- Persistence: No persistent malicious behavior detected
- Recent Activity: HTTP 200 responses with 361ms latency observed
- Risk Trend: Stable (no significant changes over time)
## Network Context
- Subnet Classification: Mostly Clean
- Abuse Density: 1 (low)
- Inherited Risk: 2 (minimal)
- Neighbor Analysis: No adjacent threats in /24 subnet
## Recommendations
SOC Action: Monitor for anomalous outbound connections from this IP. The moderate risk score is primarily due to DNSBL listings common in high-density AWS environments.
Firewall Considerations:
- Allow inbound HTTPS (TCP/443) from trusted sources
- No blocking recommended; IP is legitimate AWS infrastructure
- Monitor for DNSBL changes if previously blocked
## Intelligence Conclusion
This IP is legitimate AWS cloud infrastructure hosting web services. The moderate risk rating reflects routine DNSBL listings rather than active threat activity. No immediate defensive action required beyond standard monitoring of cloud assets.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Amazon Technologies Inc. |
| ASN | AS16509 |
| Network Name | AT-88-Z |
| CIDR Block | 52.0.0.0/10 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | ec2-52-11-153-2.us-west-2.compute.amazonaws.com |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | ec2-52-11-153-2.us-west-2.compute.amazonaws.com |
🔐 DNS Hygiene
| Hygiene Score | 80% (Excellent) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Web Server |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 443 | https | tcp | — |
| Closed Ports | 22, 25, 80, 3389, 8080, 8443 (1 open / 7 scanned) | ||
| Server | Citrix-3.2.5.9 |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | *.g.us-west-2.rdn.amazonaws.com |
| Valid From | 2026-08-03T00:00:00+00:00 |
| Valid Until | 2027-02-16T23:59:59+00:00 |
| TLS Protocol | Tls12 |
| Cipher Suite | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 |
| Signature Algorithm | sha256RSA |
| Validity Period | 197 days |
| Serial Number | 0E75515D0885F4F9344163EF24FA3D66 |
| Thumbprint | 00BD2DF707EE867BB7B86FF49DEDA5437486E6D8 |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 43% | 2 | 5 |
| routing | 13% | 1 | 1 |
| services | 32% | 2 | 3 |
| ownership | 30% | 2 | 3 |
| reputation | 28% | 1 | 3 |
| geolocation | 33% | 2 | 4 |
| Overall | 30% | 10 | 19 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (70%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-29 16:42:20 UTC |
| Last Seen | 2026-08-13 00:00:14 UTC |
| Profile Built | 2026-08-13 00:08:26 UTC |
| Data Freshness | Live |
| Signal Types | 24 |
| Total Observations | 25 |
Full dossier details are available via our API.