20.104.97.84📋 Copy

# IP Intelligence Briefing: 20.104.97.84/32

## Executive Summary

IP 20.104.97.84 is a Microsoft Azure cloud infrastructure endpoint located in Toronto, ON, Canada. The IP presents a Low Risk profile (risk score: 25) with no active threat indicators. While classified as hosting infrastructure, the endpoint shows no open services, no TLS certificates, and no active threat observations beyond a single historical proxy-type signal.

---

## Infrastructure Profile

• Organization: Microsoft Corporation (ASN: 8075)
• Network Classification: Microsoft Azure Cloud Compute
• Geolocation: Toronto, Ontario, Canada (43.65°N, -79.38°W)
• BGP Prefix: 20.64.0.0/10
• Service Status: Firewalled / No Active Services Detected
• DNS Resolution: No PTR records, no forward resolution

---

## Threat Assessment

Risk Score: 25 (Low Risk)

Threat Indicators:

• No threat indicators present
• Zero blacklist hits
• No known attacker reputation
• Not a Tor exit node, proxy, or VPN endpoint
• No known malicious campaigns

Control Plane:

• 1 DNSBL listing detected (out of 8 total lists)
• DNSSEC validated
• RPKI state: Not validated
• Route stability: False

---

## Temporal Analysis

Observation History: 21 historical observations

• Most recent signals: 2026-06-18
• Threat persistence: Single observation
• Not classified as persistently malicious
• Ownership stability: No changes detected

Historical Signals Include:

• Subnet classification (abuse density: 1, mostly_clean)
• Geolocation inference (Toronto, CA)
• Operator score: 0.1304 (Minimal)
• One proxy-type detection from proxycheck-io (risk score: 66)

---

## Network Relationships

Connected Entities: 19 Microsoft (MSFT) network relationships

• All relationships classified as "Same Network"
• Indicates Microsoft Azure infrastructure integration

Subnet Analysis (20.104.97.84/24):

• Abuse density: 0
• Classification: mostly_clean
• Threat siblings: 1
• Active siblings: 1

---

## Neighborhood Intelligence

Subnet: 20.104.97.84/24

• Neighbor count: 0
• Risk distribution: No high/medium risk neighbors detected
• Abuse density: 0

---

## Recommended Actions

Current Status: No immediate action required. The IP is classified as legitimate Microsoft Azure infrastructure with low risk characteristics.

Monitoring Recommendations:

• Continue standard monitoring for Microsoft Azure cloud endpoints
• Monitor for service emergence (currently no open ports)
• Track DNSBL listing status

Firewall Rules: No blocking recommended based on current threat profile.

---

## Intelligence Conclusions

IP 20.104.97.84 is a legitimate Microsoft Azure cloud infrastructure endpoint with minimal threat exposure. The single DNSBL listing and historical proxy-type signal warrant awareness but do not indicate active malicious use. The endpoint presents no immediate threat to SOC operations and can be treated as trusted infrastructure.

Classification: LOW RISK - Microsoft Azure Cloud Infrastructure

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.