52.96.230.226
IP Intelligence Briefing: 52.96.230.226
Ownership and Infrastructure
The asset was identified as part of Microsoft Corporation (AS8075) within the 52.96.0.0/12 CIDR block. Network role analysis classified the infrastructure as CloudCompute hosting a Web Server.
Technical Services
Open ports included TCP/80 (HTTP) and TCP/443 (HTTPS). TLS certificate validation confirmed subjects for outlook.com and associated Microsoft domains. The server banner reported Microsoft-HTTPAPI/2.0 over HTTP/2.0, returning a 301 redirect status.
Threat Assessment
Risk assessment returned a Low Risk score of 20. No active threat indicators, blacklist entries, or known campaigns were recorded. Behavioral analysis showed zero honeypot hits or active attacker status.
Geolocation and Network Discrepancies
Geolocation data indicated the United States with Toronto coordinates, though RTT measurements violated physics minimums (31ms observed vs 121.6ms minimum). Multiple geolocation sources disagreed on country attribution (US/CA).
Neighborhood Context
The /24 subnet displayed a mixed classification with an abuse density of 0.3333. Five threat siblings were detected among 15 active siblings.
Recommendation
Monitor the address due to signal contradictions regarding geolocation and RTT physics, despite the overall low-risk classification.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Microsoft Corporation |
| ASN | AS8075 |
| Network Name | MSFT |
| CIDR Block | 52.96.0.0/12 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 0% (None) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Not signed |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Web Server |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| Closed Ports | 22, 25, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | Web server detected |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | outlook.com*.hotmail.com*.internal.outlook.com*.live.com*.office.com*.office365.com*.outlook.com*.outlook.office365.comattachment.outlook.live.netattachment.outlook.office.net |
| Valid From | 2026-06-26T00:00:00+00:00 |
| Valid Until | 2027-01-10T23:59:59+00:00 |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_256_GCM_SHA384 |
| Signature Algorithm | sha256RSA |
| Validity Period | 198 days |
🛡️ Public Network Snapshot
| Origin ASN | AS8075 |
| Network Prefix | 52.96.0.0/14 |
| Route mapping | Found |
| Certificates in transparency logs | 0 certificates |
| HSTS | Not detected |
| CSP | Not detected |
| HTTP/2 | Enabled |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 25% | 1 | 1 |
| routing | 25% | 1 | 1 |
| services | 25% | 1 | 1 |
| ownership | 0% | 0 | 0 |
| reputation | 0% | 0 | 0 |
| geolocation | 35% | 2 | 2 |
| Overall | 18% | 5 | 5 |
| Data Coherence | Mixed Signals (60%) — 2 contradiction(s) |
| Attribution | Very Low (20%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
⚠ Geo sources disagree on country: CA, US
📅 Observation Timeline 🔄 Live
| First Seen | 2026-10-12 01:07:46 UTC |
| Last Seen | 2026-10-12 01:07:46 UTC |
| Profile Built | 2026-10-12 01:24:43 UTC |
| Data Freshness | Live |
| Signal Types | 24 |
| Total Observations | 24 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 52.96.230.226
Who owns the IP address 52.96.230.226?
52.96.230.226 is registered to Microsoft Corporation. The address falls within the 52.96.0.0/12 network block. Registration is held at ARIN.
Where is 52.96.230.226 located?
Geolocation data places 52.96.230.226 in Toronto, Ontario, United States. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 52.96.230.226 malicious or safe?
52.96.230.226 currently carries a low risk assessment, meaning no significant threat indicators have been observed. This assessment is generated from continuously collected signals and can change over time.
What ports are open on 52.96.230.226?
Responsive ports observed on 52.96.230.226 include 80, 443. Port visibility reflects the most recent scan and may change as the host's configuration or firewall rules change.
Is 52.96.230.226 a VPN, proxy, or data center address?
52.96.230.226 is classified as cloud infrastructure and hosting infrastructure based on network ownership and behavioural analysis.