13.52.179.28

Country / region

United States · California · San Jose

IP type

Hosting / data center

Native / broadcast

Native IP

Network

AS16509 AWS EC2 (us-west-1)

Reverse DNS

ec2-13-52-179-28.us-west-1.compute.amazonaws.com

Devices seen in subnet

27

• −40

  Honeypot node

  Flagged as a honeypot; its traffic gets close attention from security vendors

  What it means

  This address is flagged as a honeypot: a decoy machine security vendors use to attract attackers.

  Which uses care

  Barely looks at it: AI services

  Why it is weighted this way

  Its traffic is closely watched by security vendors; there is no upside to using it as an egress, hence a hard cap.

  Can it be fixed

  An inherent attribute of the IP or its range; nothing a user can change short of a different IP.

• −25

  IP type: Hosting / data center

  Hosting / data center IPs are the main source of automated traffic

  What it means

  This IP sits in a hosting / datacenter range. Platforms assume real people browse from home or a phone, and machines live in datacenters.

  Which uses care

  Cares most: AI services, Social sign-up, Gaming platforms, Cross-border e-commerce; Barely looks at it: Email sending

  Why it is weighted this way

  The most basic signal there is: scrapers, bulk sign-ups and fake traffic overwhelmingly come from datacenters, so risk systems discount the whole range. It says nothing about what you did, only that you share the range.

  Can it be fixed

  The range type cannot be changed. What helps is not stacking other issues on top: stay off blocklists, close unneeded ports, avoid crowded exits.

• −20

  Known VPN exit

  Only 1 data source flags it as a VPN; the evidence is limited, so it counts at half weight

  What it means

  Commercial risk databases mark this address as a VPN server exit. Platforms see "someone on a VPN", not you.

  Which uses care

  Cares most: AI services, Social sign-up, Streaming / short video, Gaming platforms, Cross-border e-commerce

  Why it is weighted this way

  Only one source says so, and a single database can be wrong (public DNS resolvers have been mislabeled), so it counts at half weight. If a second source follows in a few days, this item doubles.

  Can it be fixed

  Self-hosted proxies on VPS ranges are often labeled block-wide; changing the IP is the only fix. Commercial VPN exits are labeled by design.

• −8

  Cloud provider range (AWS)

  Public cloud IPs can be rented cheaply by anyone, so they rate below self-run data centers

  What it means

  The address falls inside a public cloud provider's published range; anyone can rent a machine in the same range within minutes.

  Which uses care

  Cares most: AI services, Social sign-up, Gaming platforms, Cross-border e-commerce; Barely looks at it: Email sending

  Why it is weighted this way

  A small extra deduction on top of the datacenter one: public cloud has a lower barrier than private hosting and abuse is more concentrated.

  Can it be fixed

  Range membership cannot be changed; different regions of the same cloud, or independent datacenters, are labeled differently.

• −8

  50 known vulnerabilities

  Mostly matched from software version banners; it shows the machine is unmaintained, and platform risk systems do not look at this directly: CVE-2020-27218, CVE-2012-6708, CVE-2022-2048 and more

  What it means

  Scanners matched the version banners of exposed services to published CVE numbers. Most are just version matches, not confirmed exploitable holes.

  Which uses care

  Barely looks at it: AI services

  Why it is weighted this way

  It shows the machine is unmaintained, another sign of "server"; platform risk systems never count CVEs on an IP. Capped at 8 points (20 before 2026-09-26, which pushed ordinary VPS into "very high risk" for one fact charged three times).

  Can it be fixed

  Update the system and the services exposed to the internet (sshd above all); scanners update within days, then re-check.

• −6

  3 open ports

  Open ports: 3542, 12561, 50106

  What it means

  Scanners see ports open on this IP. With admin ports such as 22 or 3389 it is almost certainly a server, not a home router.

  Which uses care

  Barely looks at it: AI services

  Why it is weighted this way

  Mainly corroboration that "this is a server", which the datacenter item already charged for, so only a few points here; AI-type scenarios weight it at 0.3 to avoid charging the same fact three times.

  Can it be fixed

  Close or restrict ports that do not need public access (firewall, non-default port, fail2ban); scanners update within days, then re-check. One of the few items you can change yourself.

• −6

  rDNS looks like a server

  Reverse hostname ec2-13-52-179-28.us-west-1.compute.amazonaws.com matches server naming

  What it means

  The reverse hostname follows server naming (server, vps, host and the like).

  Which uses care

  Cares most: Email sending

  Why it is weighted this way

  A light deduction: one more sign of "this is a server".

  Can it be fixed

  You can change the PTR in the host's panel, but it is only corroboration and barely moves the total.

• +5

  Native IP

  Registered and used in the same country, allocated directly by a local carrier

  What it means

  Registered and used in the same country, allocated directly by a local carrier: a "native IP".

  Which uses care

  Cares most: Streaming / short video, Gaming platforms; Barely looks at it: Email sending

  Why it is weighted this way

  A bonus: region-based checks will not trip.

  Can it be fixed

  An inherent attribute of the IP or its range; nothing a user can change short of a different IP.

Not listed on any of the 8 blocklists checked (Spamhaus ZEN, SpamCop, PSBL, blocklist.de, UCEPROTECT L1, s5h.net, DroneBL, SpamRats).

• abuseipdb abuse confidence 0%

Open ports observed: 3542, 12561, 50106

Each platform's internal risk labels

Platforms keep their own IP reputation data and ban records and do not publish them. No hit in public sources does not mean a platform has nothing on this IP.

Whether the IP is truly exclusive

Sharing is only the number of devices observed in the same subnet. It cannot show who else is using this exit right now, or what they are doing.

Which accounts this IP has been tied to

Account-to-IP links exist only inside each platform. Accounts previously banned on this IP are invisible to us.

Device, browser and behaviour

Risk systems look at IP + device fingerprint + behavioural rhythm together. A clean IP with an odd fingerprint or behaviour still gets blocked.

Whether the account profile matches the IP

When sign-up country, phone number, payment method, language or time zone disagree with the IP's location, platforms verify further. That is unrelated to IP purity.

• rdap
  305ms
• team-cymru
  112ms
• ip-api.com
  128ms
• proxycheck.io
  185ms
• abuseipdb
  151ms
• cloud-ranges
  8ms
• tor-exits
  8ms
• rdns
  478ms
• shodan-internetdb
  220ms
• ipwho.is
  128ms
• dnsbl
  282ms

Machine-readable versions of this report: JSON · plain text · 中文报告