52.96.111.50
An intelligence profile was generated for IP 52.96.111.50, which was identified as belonging to Microsoft Corporation (ASN 8075) within the 52.96.0.0/12 block. Geolocation data indicated Redmond, WA, with the network role classified as a web server hosting HTTP and HTTPS traffic on ports 80 and 443. A TLS certificate was observed for outlook.com and associated domains, issued by DigiCert.
The overall reputation was rated Low Risk with a risk score of 25. No specific threat indicators, known campaigns, or attacker classifications were recorded. The IP was not flagged as a spam source, though it was listed on one DNSBL out of eight lists checked. Signal contradictions were identified, specifically where the claimed geolocation contradicted RTT physics measurements (27ms RTT against a distance of 6379.9km). The 52.96.111.0/24 subnet showed mixed classification with three active threat siblings.
Due to the presence of signal contradictions, the recommended action was to monitor the asset with low severity. No specific firewall rules were suggested.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Microsoft Corporation |
| ASN | AS8075 |
| Network Name | MSFT |
| CIDR Block | 52.96.0.0/12 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | 5/7 domains |
| DMARC | 6/7 domains |
| FCrDNS | Not verified |
| DNSSEC | Not signed |
| CAA | Not configured |
| Domains Checked | 7 domains |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| Closed Ports | 22, 25, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | Microsoft-HTTPAPI/2.0 |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | outlook.com*.hotmail.com*.internal.outlook.com*.live.com*.office.com*.office365.com*.outlook.com*.outlook.office365.comattachment.outlook.live.netattachment.outlook.office.net |
| Valid From | 2026-06-26T00:00:00+00:00 |
| Valid Until | 2027-01-10T23:59:59+00:00 |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_256_GCM_SHA384 |
| Signature Algorithm | sha256RSA |
| Validity Period | 198 days |
| Serial Number | 0E371D2766FD365DADDCF4004297839E |
| Thumbprint | C7C19E04464D744D810EF31A24C54FC22A7909C5 |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 35% | 2 | 3 |
| routing | 13% | 1 | 1 |
| services | 27% | 2 | 3 |
| ownership | 27% | 2 | 3 |
| reputation | 19% | 1 | 2 |
| geolocation | 19% | 2 | 2 |
| Overall | 23% | 10 | 14 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Low (35%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-09-13 05:09:39 UTC |
| Last Seen | 2026-09-21 10:25:09 UTC |
| Profile Built | 2026-09-21 10:42:53 UTC |
| Data Freshness | Live |
| Signal Types | 25 |
| Total Observations | 38 |
Full dossier details are available via our API.