104.208.96.111📋 Copy

Threat Intelligence Briefing: IP 104.208.96.111/32

Profile Overview:

• Provider: Microsoft Corporation (Microsoft Azure)
• Geolocation: Hong Kong (HK), but associated with Microsoft's infrastructure in San Francisco, CA.
• Risk Score: Moderate (50/100)
• Network Role: Cloud compute resource (Azure) with no active services or open ports detected.
• Ownership: ASN 8075 (Microsoft), classified as "mostly_clean" with no abuse indicators.

Threat Indicators:

• No malicious activity, spam, or known attacker associations detected.
• DNSSEC validation is active, but geolocation plausibility is questionable due to mismatch between Hong Kong and Microsoft's infrastructure.

Network Relationships:

• Linked to Microsoft's Azure network (MSFT) via BGP and subnet routing.
• No connections to other subnets or organizations.

Neighborhood Analysis:

• Subnet 104.208.96.0/24 has 2 IPs, 1 with medium risk (104.208.96.246).
• Subnet abuse density is low (0.5), but the single high-risk neighbor warrants monitoring.

Observation History:

• Stable over 30 days, with consistent Azure infrastructure classification.
• Recent DNSSEC validation and route stability checks passed.

Actionable Insights:

1. Monitor Neighbor: The subnet's single medium-risk IP (104.208.96.246) may pose a risk; investigate its activity.

2. Verify Geolocation: Discrepancy between Hong Kong and Microsoft's infrastructure suggests potential misclassification or routing anomalies.

3. Maintain Allowance: No blocking required for this IP, but ensure firewall rules account for its Azure cloud role.

Conclusion:

This IP is a legitimate Microsoft Azure resource with no immediate threats. Focus on the subnet's high-risk neighbor and validate geolocation data for accuracy.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.