130.131.3.72📋 Copy

# IP INTELLIGENCE BRIEFING: 130.131.3.72/32

## Executive Summary

The target IP 130.131.3.72 is a Microsoft Azure cloud infrastructure address with an overall risk score of 25 (Low Risk). The IP is geolocated to Chicago, IL, and is currently configured with no open services, presenting minimal immediate threat. However, recent DNSBL listings indicate historical abuse activity that warrants monitoring.

## Infrastructure Profile

• ASN: 8075 (Microsoft Azure)
• Organization: Divya Quamara
• Geolocation: Chicago, IL, United States (41.88°N, -87.63°W)
• Infrastructure Type: Cloud Compute
• Network Classification: Cloud hosting with no active services
• Service Status: Firewalled / No Services Detected

## Threat Assessment

• Risk Score: 25 (Low Risk)
• Threat Indicators: None detected
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Status: 0 current listings
• Campaign Association: No known campaigns correlated

## Historical Observations

The IP has generated 22 signal observations. Recent activity includes:

• One high-severity DNSBL listing observed on 2026-06-26 (8 total listings)
• Consistent geolocation signals from Chicago, IL
• Operator score: 0 (Minimal)
• No persistent malicious behavior detected
• Zero threat persistence days

## Neighborhood Analysis

• Subnet: 130.131.3.72/24
• Abuse Density: 0%
• Classification: Clean
• Threat Siblings: 0
• Active Siblings: 1
• Inherited Risk: 0

## Control Plane Data

• Origin ASN: 8075
• BGP Prefix: 130.131.0.0/16
• Route Stability: Unstable
• RPKI State: Not evaluated
• DNSSEC Valid: Yes

## Network Relationships

• 49 relationships detected, predominantly same-network cloud infrastructure associations
• No unique organizational or certificate relationships identified

## Recommendations

1. Monitor: Track for renewed DNSBL activity following the 2026-06-26 listing event

2. Allow: No immediate blocking required; low risk profile

3. Contextualize: Consider as legitimate Azure infrastructure; no active services detected

4. Review: Monitor subnet 130.131.3.0/24 for any changes in abuse density

## SOC Action

No immediate defensive action required. The IP represents a low-risk cloud infrastructure address. Routine monitoring is sufficient.

---

*Intelligence generated from IPDebrief analysis tools. Data current as of analysis timestamp.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.