20.173.116.24📋 Copy

# IP INTELLIGENCE BRIEFING: 20.173.116.24

## Executive Summary

Microsoft Azure cloud infrastructure address classified as MODERATE RISK (65/100) with elevated DNSBL listings and active SSH service exposure. Requires monitoring and consideration for blocking based on organizational risk tolerance.

## Asset Profile

## Threat Indicators

• DNSBL Listings: 3/8 lists (High severity maximum)
• Control Plane: Route stability issues detected (isRouteStable=false)
• Operator Score: 0.2174 (Minimal)
• DNSBL Count: 3 total listings
• Persistence: 1 threat observation (not persistently malicious)

## Service Exposure

• Port 22/TCP: SSH (OpenSSH_8.9p1 Ubuntu-3ubuntu0.15)
• TLS/Certificates: None detected
• HTTP Services: Not detected
• Banner Analysis: SSH service banner confirmed

## Neighborhood Analysis

• Subnet: 20.173.116.24/24
• Abuse Density: Minimal (0-1)
• Classification: Mostly clean
• Active Siblings: 1 (1 threat sibling identified)

## Historical Trend

29 observations recorded. Recent signals indicate:

• Minimal operator risk (0.25 raw score)
• Confirmed cloud infrastructure (Microsoft Azure)
• No persistent malicious activity detected
• DNSBL activity present in recent observations

## Intelligence Assessment

This IP represents Microsoft Azure cloud infrastructure with moderate risk classification. The elevated risk score (65/100) combined with DNSBL listings suggests potential abuse or configuration issues. SSH exposure on port 22 provides a legitimate service access point that may be targeted. Geographic discrepancy (US registration, Qatar geolocation) warrants attention but is consistent with Azure's global infrastructure.

No evidence of active campaign participation or persistent malicious behavior.

## Recommended Actions

Immediate

• Increase logging verbosity for traffic from 20.173.116.24
• Review recent activity patterns and connection attempts

Firewall Rules

```bash

# iptables

iptables -A INPUT -s 20.173.116.24 -j DROP

# nftables

nft add rule inet filter input ip saddr 20.173.116.24 drop

# nginx

deny 20.173.116.24;

# pfSense

20.173.116.24/32

```

Cloud Platform Rules

```json

// Cloudflare WAF

{"description":"Block 20.173.116.24 — IPDebrief risk score 65","action":"block","filter":{"expression":"ip.src eq 20.173.116.24"}}

// AWS WAF

{"Addresses":["20.173.116.24/32"],"Description":"IPDebrief risk 65"}

```

## Final Recommendation

MONITOR — Elevated risk classification warrants increased visibility. Consider blocking if threat intelligence correlation identifies this IP as malicious. Microsoft Azure infrastructure should be evaluated against known threat actor patterns before implementing blocking.

---

*Generated via IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.