52.218.222.25
IP Intelligence Briefing: 52.218.222.25/32
The IP address 52.218.222.25 was identified as infrastructure owned by Amazon Technologies Inc. (ASN 16509) within the AT-88-Z block. Operational data indicated the host functions as an Amazon S3 Web Server, listening on TCP ports 80 and 443. DNS records resolved to `s3-us-west-2-r-w.amazonaws.com` with TLS certificates issued by Amazon RSA 2048 M04.
The asset was assigned a Low Risk reputation score of 25, with no active blacklist listings and zero confirmed incidents. Despite the low risk classification, the threat actor profile categorized the host as "Suspicious" due to the presence of threat indicators without specific campaign attribution. Data integrity analysis revealed contradictions, specifically noting that claimed geolocation (Portland, OR) conflicted with RTT physics measurements.
Recommendations from the assessment advised analysts to Monitor the address for changes due to conflicting signals and low confidence levels. The host remains classified as a Tier 3 network operator with valid RPKI state.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Amazon Technologies Inc. |
| ASN | AS16509 |
| Network Name | AT-88-Z |
| CIDR Block | 52.192.0.0/12 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | s3-us-west-2-r-w.amazonaws.com |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | s3-us-west-2-r-w.amazonaws.com |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Not verified |
| DNSSEC | Not signed |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Web Server |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| Closed Ports | 22, 25, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | AmazonS3 |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | *.s3-us-west-2.amazonaws.com*.s3.amazonaws.coms3-control.us-west-2.amazonaws.com*.s3.dualstack.us-west-2.amazonaws.coms3-deprecated.us-west-2.amazonaws.coms3-control.dualstack.us-west-2.amazonaws.com*.s3-deprecated.us-west-2.amazonaws.coms3.amazonaws.coms3.dualstack.us-west-2.amazonaws.com*.s3-control.dualstack.us-west-2.amazonaws.com |
| Valid From | 2025-11-18T00:00:00+00:00 |
| Valid Until | 2026-10-30T23:59:59+00:00 |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_128_GCM_SHA256 |
| Signature Algorithm | sha256RSA |
| Validity Period | 346 days |
| Serial Number | 0F061457518182D12E2A6E2A1F0B6A58 |
| Thumbprint | F8A8052C6A4D1B65BBE8A25159D059B84184CB1E |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 25% | 1 | 1 |
| routing | 25% | 1 | 1 |
| services | 25% | 1 | 1 |
| ownership | 50% | 2 | 3 |
| reputation | 0% | 0 | 0 |
| geolocation | 25% | 1 | 1 |
| Overall | 25% | 6 | 7 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Moderate (65%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-09-10 05:59:23 UTC |
| Last Seen | 2026-09-10 05:59:23 UTC |
| Profile Built | 2026-09-10 06:13:23 UTC |
| Data Freshness | Live |
| Signal Types | 30 |
| Total Observations | 30 |
Full dossier details are available via our API.