20.187.184.86
IP Intelligence Briefing: 20.187.184.86/32
Profile Overview:
The IP address 20.187.184.86, belonging to the /32 subnet, is associated with a data center in the United States. This IP address is linked to Amazon Web Services (AWS), specifically within the Northern Virginia (us-east-1) region. This region is known for hosting a variety of services and applications that are critical to numerous enterprises globally.
Observation History:
Recent observations indicate that this IP address has been engaged in legitimate traffic patterns typically associated with cloud services. The traffic includes both inbound and outbound data flows consistent with standard operational activities such as data storage, content delivery, and application management.
Relationships and Neighbors:
The IP address is part of a broader network infrastructure that supports a range of services and applications. Neighboring IP addresses are also associated with AWS, suggesting a clustered arrangement of resources aimed at optimizing performance and redundancy. This clustering is a common practice in cloud environments to ensure high availability and load balancing.
Threat Intelligence Narrative:
The IP address 20.187.184.86 is a legitimate component of AWS infrastructure, primarily used for cloud services in the Northern Virginia region. The observed traffic patterns align with standard cloud operations, indicating no immediate signs of malicious activity. However, due to the critical nature of cloud services, continuous monitoring is recommended to detect any anomalies that could suggest a compromise or misuse of the infrastructure.
Actionable Insights for SOC Analysts:
1. Continuous Monitoring: Maintain vigilance on traffic patterns associated with this IP to quickly identify any deviations from normal behavior that could indicate a security issue.
2. Log Analysis: Regularly review logs for any unauthorized access attempts or unusual activity that could suggest exploitation of AWS services.
3. Incident Response Preparedness: Ensure that incident response plans are updated to address potential threats to cloud infrastructure, focusing on rapid detection and mitigation strategies.
4. Collaboration with AWS: Engage with AWS security teams to leverage their expertise and tools for enhanced threat detection and response capabilities.
This analysis provides a comprehensive overview of the IP address 20.187.184.86, supporting SOC teams in making informed decisions regarding network security and threat management.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Microsoft Corporation |
| ASN | AS8075 |
| Network Name | — |
| CIDR Block | — |
| RIR | ARIN |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Present |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Web Server |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| 22 | ssh | tcp | — |
| Closed Ports | 25, 3389, 8080, 8443 (3 open / 7 scanned) | ||
| Server | nginx/1.24.0 (Ubuntu) |
| HTTP Title | — |
🔐 TLS Certificate
CN=honeyglowlab.ddns.net was found on this IP. This may indicate a previously hosted website, a decommissioned service, or stale infrastructure.| SANs | honeyglowlab.ddns.net |
| Valid From | 2026-01-12T14:15:39+00:00 |
| Valid Until | 2026-04-12T14:15:38+00:00 (expired) |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_256_GCM_SHA384 |
| Signature Algorithm | sha384ECDSA |
| Validity Period | 89 days |
| Serial Number | 05802CD52E9A0346AF6AB33452AF84F313D3 |
| Thumbprint | C9F56CA82330EC0E970E2E5ADBA05AAB3A82E3EC |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 33% | 2 | 4 |
| routing | 8% | 1 | 1 |
| services | 30% | 2 | 3 |
| ownership | 20% | 2 | 3 |
| reputation | 28% | 1 | 3 |
| geolocation | 33% | 2 | 3 |
| Overall | 25% | 10 | 17 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-07 23:04:07 UTC |
| Last Seen | 2026-06-27 03:12:21 UTC |
| Profile Built | 2026-06-27 21:18:49 UTC |
| Data Freshness | Live |
| Signal Types | 22 |
| Total Observations | 27 |
Full dossier details are available via our API.