172.202.118.72📋 Copy

IP INTELLIGENCE BRIEFING: 172.202.118.72/32

Classification: Microsoft Azure Cloud Infrastructure | Moderate Risk (Score: 50)

---

EXECUTIVE SUMMARY

IP 172.202.118.72 is a Microsoft Azure cloud compute endpoint classified as moderate risk (50). The IP belongs to the 172.202.0.0/16 CIDR block and resolves to a stretchoid.com hostname. No active malicious indicators detected. Infrastructure shows standard cloud behavior with firewalled/no services status.

---

OWNERSHIP & NETWORK CLASSIFICATION

• ASN: 8075 (Microsoft Azure)
• Organization: Divya Quamara
• Network: 172.202.0.0/16
• RIR: ARIN
• Infrastructure Type: CloudCompute
• Network Role: Microsoft Azure Cloud (Firewalled / No Services)

---

GEOLOCATION

• Country: United States (US)
• Region: Iowa
• City: Des Moines
• GeoSource Consensus: Mixed (2 sources, not unanimous)
• Validation: GeoPlausible confirmed despite ICMP blocking

---

DNS & HOSTING ANALYSIS

• PTR Record: azpdcsr7gls9.stretchoid.com
• Forward Resolution: azpdcsr7gls9.stretchoid.com
• Services: No open ports detected (firewalled)
• TLS/Certificates: None detected
• DNSBL Listings: 2 of 8 total lists

---

THREAT ASSESSMENT

• Abuse Confidence Score: Not available
• Blacklist Count: 0
• Known Campaigns: None correlated
• Tor Exit: No
• Known Attacker: No
• Spam Source: No
• DNSBL Status: 2 listings detected (monitor for escalation)

---

NETWORK CONTEXT & NEIGHBORHOOD

• Subnet: 172.202.118.0/24
• Abuse Density: 0.1429 (14.29%)
• Total Siblings: 14 active IPs
• Threat Siblings: 2
• Risk Distribution: High: 0, Medium: 3, Low: 10
• Highest Risk Neighbor: 172.202.118.22 (Score: 50)

---

OBSERVATION HISTORY

• Total Observations: 22
• Recent Activity: 2026-08-13 (multiple signals)
• Threat Persistence: Low (0 threat observation days)
• Ownership Stability: Stable (0 ownership changes)
• Signal Quality: Variable confidence (0.27–0.95)

---

SOC RECOMMENDATIONS

1. Firewall Policy: Allow standard Microsoft Azure traffic patterns; no immediate blocking required

2. Monitoring: Track DNSBL listing count for escalation; currently at 2 of 8

3. Context: This is legitimate cloud infrastructure. Correlate with known Azure traffic baselines

4. Investigation Trigger: If 172.202.118.22 (neighbor) escalates to active threat, expand investigation to 172.202.118.0/24 subnet

5. No Immediate Action Required: No open services, no active threats, standard cloud behavior

---

RISK RATING: MODERATE (50/100) — Cloud infrastructure with no active malicious indicators. Monitor for DNSBL escalation or neighbor activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.