# 52.231.164.86 — IP Intelligence Summary 52.231.164.86 is an IPv4 address operated by Microsoft Corporation (AS8075), geolocated to Busan, South Korea. It belongs to datacenter or hosting infrastructure. As of November 6, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/52.231.164.86 - Last updated: 2026-11-06 ## Ownership - Organization: Microsoft Corporation - Network name: MSFT - Allocated block: 52.224.0.0/11 - ASN: AS8075 (https://ipdebrief.com/asn/8075) - Regional registry: ARIN - Cloud / hosting provider: Microsoft Azure ## Location - City: Busan - Region: Busan - Country: South Korea - Time zone: — ## Network classification - Infrastructure type: — - Datacenter / hosting: yes - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Low Risk (25/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative \## IP Intelligence Briefing: 52.231.164.86/32 **Classification:** Low Risk / Legitimate Cloud Infrastructure **Analysis Date:** Current **Risk Score:** 25/100 \### Executive Summary IP address 52.231.164.86 is identified as Microsoft Corporation infrastructure within the Microsoft Azure cloud environment (ASN 8075). The asset presents a low risk profile with no active threat indicators, no known malicious campaigns, and no evidence of abuse activity. Classification indicates legitimate cloud compute infrastructure. \### Ownership and Network Classification \- **Organization:** Microsoft Corporation (MSFT) \- **ASN:** 8075 \- **CIDR Block:** 52.224.0.0/11 \- **Infrastructure Type:** CloudCompute (Microsoft Azure) \- **RIR:** ARIN \- **Network Role:** Cloud Hosting Provider \### Geolocation Analysis Geolocation data exhibits geographic inconsistency across data sources: \- Primary consensus: United States (39.83°N, -98.58°W) \- Secondary source: South Korea, Busan (35.1025°N, 129.0394°E) \- Accuracy radius: 2500 km \- GeoConsensus: Mixed sources detected This inconsistency is typical for cloud infrastructure where load balancing and geographic distribution may result in varying geolocation reports. \### Threat Indicators \- **Abuse Confidence Score:** Not available \- **Blacklist Count:** 0 \- **Known Attacker:** No \- **Spam Source:** No \- **Tor Exit Node:** No \- **Known Campaigns:** None detected \- **Threat Feeds:** None \### Network Services and DNS \- **Open Ports:** None detected \- **DNS Records:** No PTR hostnames, no forward resolution \- **Email Authentication:** No SPF, DMARC, or TXT records detected \- **HTTP Services:** No HTTP title or server banner detected \- **TLS Certificates:** None detected \### Control Plane Analysis \- **Route Stability:** Unstable (isRouteStable: false) \- **BGP Prefix:** 52.224.0.0/11 \- **Origin ASN:** 8075 \- **RPKI State:** Not available \- **DNSBL Listings:** Listed on 1 of 8 DNSBL lists \- **Operator Score:** 0.1304 (Minimal) \- **MoAS Classification:** No \- **IRR Consistency:** Not available \### Historical Signal Analysis Observation history contains 15 recorded signals with the following patterns: \- **Temporal Trend:** No significant changes in risk profile over observation period \- **Geographic Consistency:** Variable (US/Korea) \- **Classification Consistency:** Maintained as "clean" \- **Abuse Density:** 0 \- **Threat Persistence:** 0 days \- **Observation Count:** 0 threat observations \### Neighborhood Analysis \- **Subnet:** 52.231.164.86/24 \- **Total Siblings:** 1 \- **Active Siblings:** 0 \- **Threat Siblings:** 0 \- **Abuse Density:** 0 \- **Classification:** Clean No neighboring IPs within the /24 subnet present elevated risk indicators. \### Relationship Graph Four relationships detected, all indicating "Same Network" association with MSFT. No external relationships to organizations, hostnames, or certificates identified. \### Recommended Actions **Risk Score:** 25/100 (Low Risk) No specific firewall rules or security actions are currently recommended. Given the low risk score and Microsoft Azure cloud infrastructure classification, this IP may be safely permitted for inbound traffic unless specific organizational security policies dictate otherwise. \### Intelligence Narrative IP 52.231.164.86 represents legitimate Microsoft Azure cloud infrastructure with no evidence of malicious activity. The absence of open ports, services, or threat indicators, combined with zero blacklist hits and clean neighborhood analysis, supports classification as benign cloud infrastructure. The geographic inconsistencies are attributable to Azure's distributed architecture and load balancing mechanisms. Route instability reflects typical cloud provider BGP dynamics rather than malicious activity. SOC analysts should treat this IP as low-risk and may permit traffic unless specific threat intelligence suggests otherwise. No immediate action required. **Status:** Monitor / No Action Required --- Source: IPDebrief, "52.231.164.86 IP intelligence", https://ipdebrief.com/52.231.164.86, updated 2026-11-06. Assessments are probabilistic.