13.89.126.64📋 Copy

# IP Intelligence Briefing: 13.89.126.64/32

## Executive Summary

The IP address 13.89.126.64 is identified as a Microsoft Azure cloud compute infrastructure endpoint with a low risk profile (risk score: 25). The IP is classified as clean with no active threat indicators, no open services, and zero abuse density within its /24 subnet. No security actions are recommended based on current intelligence.

## Ownership & Infrastructure

## Threat Assessment

Risk Classification: LOW RISK (Score: 25/100)

Threat Indicators:

• Blacklist Count: 0 active entries
• Known Campaigns: None detected
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

Control Plane Analysis:

• DNSSEC Valid: Yes
• DNSBL Listed: 1 of 8 total lists (high severity)
• Operator Score: 0.1304 (Minimal)
• Route Stability: False

## Service & Network Status

• Open Ports: None detected
• TLS Certificate: None
• HTTP Title: None
• Connection Type: Firewalled / No Services
• DNS Records: No PTR hostnames, no forward resolution
• Email Authentication: No SPF/DMARC records detected

## Historical Observation Timeline

Total observations: 15 signals across multiple dates

Recent Signals (August 2026):

• Geolocation: Consistent Des Moines, IA location (confidence: 0.80)
• Blacklist Status: 1 of 8 lists flagged (high severity)
• Operator Score: 0.15 (Minimal)
• Network Scan: No open ports detected

Temporal Analysis:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Is Persistently Malicious: No
• Threat Observation Count: 0

## Neighborhood Analysis

Subnet: 13.89.126.64/24

• Abuse Density: 0 (clean)
• Total Siblings: 1
• Active Siblings: 0
• Threat Siblings: 0
• Classification: Clean

## Relationship Graph

8 relationships identified, all categorized as "Same Network" pointing to Microsoft (MSFT). No external organizational relationships detected.

## Recommended Actions

Based on current risk profile (25/100):

• No firewall rules generated
• No additional monitoring required beyond standard cloud infrastructure baselines
• The single DNSBL listing warrants awareness but does not indicate active malicious activity

## Intelligence Narrative

13.89.126.64 operates as a Microsoft Azure cloud compute endpoint with legitimate infrastructure characteristics. The IP exhibits typical cloud provider behavior: firewalled, no exposed services, and consistent geolocation data. The low risk score combined with zero open ports and no active threat indicators suggests this is a benign Azure infrastructure address. The single DNSBL listing requires monitoring but does not correlate with any known attack campaigns. SOC analysts should treat this as a trusted cloud infrastructure IP without requiring special blocking or alerting actions.

Status: Monitor as part of standard Microsoft Azure traffic baselines.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.