8.210.88.252📋 Copy

IP Intelligence Briefing: 8.210.88.252

Date: 2026-06-13

---

**1. Core Profile**

• Risk Score: 50 (Moderate Risk)
• Geolocation:

- Primary: United States (US)

- Observed in Hong Kong (HK) via multi-signal inference (low confidence, 0.28).

• Ownership:

- Registered to IRT-ASEPL-SG (Alibaba Cloud, HK).

- Abuse contact: `abuse@alibaba-inc.com`.

• Network Role:

- Firewalled / No Services (no open ports, TLS, or HTTP detected).

- BGP prefix: `8.210.0.0/17` (origin ASN: 45102).

- DNSSEC valid, no CAA records.

---

**2. Threat Indicators**

• No direct malicious indicators:

- No known attacker, spam, or Tor exit node associations.

- 0 threat feeds or campaigns linked.

• DNSBL Listings:

- Listed in 2/8 DNSBLs (low-severity, likely false positives).

• Behavioral Flags:

- No honeypot hits, WAF violations, or enumeration attempts.

---

**3. Observation History**

• Geolocation Anomalies:

- Confirmed US location (100% consensus), but HK spoofed signals (2/11 observations).

- One observation with 45 km accuracy radius (HK, 0.28 confidence).

• Ownership Stability:

- No ownership changes detected.

• Threat Persistence:

- No persistent malicious activity (0 threat observations).

---

**4. Relationships**

• No direct relationships (e.g., subnets, domains, certificates) found.
• No correlated IPs or campaign links.

---

**5. Subnet Neighborhood**

• Subnet: `8.210.88.252/24`
• Abuse Density: 0% (low-risk environment).
• Neighbors:

- 8.210.88.179: Risk score 25 (low risk, no malicious indicators).

---

**6. Control Plane & Routing**

• BGP Stability:

- Route stable (no recent changes).

- RPKI invalid for `8.210.0.0/17` (ASN 45102).

• Transit Networks:

- Routed via Comcast and NTT.

---

**7. Recommendations**

• Verify Geolocation Anomalies:

- Investigate HK spoofed signals; check for multi-homed infrastructure or spoofing.

• Monitor DNSBL Listings:

- Confirm if these are false positives or indicative of spam/abuse.

• Validate Ownership:

- Confirm Alibaba Cloud’s ownership of `8.210.0.0/16` via ARIN records.

• No Immediate Action Required:

- IP shows no active malicious behavior, but low-risk DNSBL listings warrant continued monitoring.

---

Product: IPDebrief | Copyright: © 2026 Jason Alberino. All rights reserved.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.