# 20.190.139.173 — IP Intelligence Summary

20.190.139.173 is an IPv4 address operated by Microsoft Corporation (AS8075), geolocated to Redmond, United States. It belongs to datacenter or hosting infrastructure. As of October 30, 2026, IPDebrief rates it High Risk (70/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/20.190.139.173
- Last updated: 2026-10-30

## Ownership

- Organization: Microsoft Corporation
- Network name: MSFT
- Allocated block: 20.180.0.0/14
- ASN: AS8075 (https://ipdebrief.com/asn/8075)
- Regional registry: ARIN
- Cloud / hosting provider: Microsoft Azure

## Location

- City: Redmond
- Region: WA
- Country: United States
- Time zone: America/Los_Angeles

## Network classification

- Infrastructure type: —
- Datacenter / hosting: yes
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: High Risk (70/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Exposed services

- 80/tcp — http
- 443/tcp — https

## Analyst narrative

The IP address 20.190.139.173 was observed on Microsoft Azure infrastructure (Microsoft Corporation, ASN 8075). Geolocation data placed the asset in Redmond, Washington, but RTT measurements contradicted the distance physics, flagging the record as implausible. The address carried a High Risk score of 70 and was classified as Campaign Infrastructure with a high likelihood of malicious activity. Threat correlation identified 16 associated IPs and certificate matches for graph.microsoft.com. The asset was flagged for blocking with a critical severity recommendation. Observations spanned from September 27 to October 12, 2026. SOC analysts were advised to block the IP using firewall rules due to the high risk score and strong threat evidence.

## Nearby addresses

- 20.190.139.168 (https://ipdebrief.com/20.190.139.168)
- 20.190.139.174 (https://ipdebrief.com/20.190.139.174)

## Addresses sharing infrastructure

- 20.190.151.33 — Same TLS certificate (https://ipdebrief.com/20.190.151.33)
- 20.190.151.37 — Same TLS certificate (https://ipdebrief.com/20.190.151.37)
- 20.190.151.38 — Same TLS certificate (https://ipdebrief.com/20.190.151.38)
- 20.190.151.100 — Same TLS certificate (https://ipdebrief.com/20.190.151.100)
- 20.190.152.24 — Same TLS certificate (https://ipdebrief.com/20.190.152.24)
- 20.190.152.88 — Same TLS certificate (https://ipdebrief.com/20.190.152.88)
- 20.190.152.102 — Same TLS certificate (https://ipdebrief.com/20.190.152.102)
- 20.190.152.103 — Same TLS certificate (https://ipdebrief.com/20.190.152.103)
- 20.190.152.104 — Same TLS certificate (https://ipdebrief.com/20.190.152.104)
- 20.190.152.105 — Same TLS certificate (https://ipdebrief.com/20.190.152.105)
- 20.190.152.106 — Same TLS certificate (https://ipdebrief.com/20.190.152.106)

---

Source: IPDebrief, "20.190.139.173 IP intelligence", https://ipdebrief.com/20.190.139.173, updated 2026-10-30. Assessments are probabilistic.