20.203.154.158

{ } JSON 🔧 Full Actions API

🤖 Witness AIThis summary was generated by AI and may contain inaccuracies. Verify critical details independently.

IP Intelligence Briefing: 20.203.154.158

Date: 2026-06-14

1. Core Profile

Risk Score: Low Risk (25/100) | Provider Score: 0 | Authority Score: 0
Ownership: Microsoft Corporation (ASN 8075) | ARIN-registed | No abuse reports
Geolocation: United States (US) | Region: ZH | City: Zurich (plausibility: 2500km accuracy radius)
Network Role: Microsoft Azure cloud compute infrastructure (firewalled, no services exposed)

2. Threat Indicators

No malicious indicators detected (0 threat feeds, 0 blacklists, 0 campaigns)
Not a Tor exit node, VPN, CDN, or residential IP
DNSSEC valid, no DNSBL listings

3. Observation History

First observed on 2026-06-02 | Last observed 2026-06-14
Stable ownership (0 changes) | No persistent malicious activity

4. Relationships

Linked to 19 "MSFT" network entities (same ASN, provider, and infrastructure)
No external subnets or organizations associated

5. Neighborhood Analysis

/24 subnet (20.203.154.0/24) | Abuse density: 0 (clean)
No neighboring IPs identified (potential data limitation)

6. Recommendations

Monitor: Track for sudden ownership changes or service exposure.
Allowlist: Confirm legitimacy as Microsoft Azure infrastructure.
No Action Required: No threats detected; low-risk cloud asset.

Conclusion:

The IP is a legitimate Microsoft Azure cloud resource with no malicious activity detected. Its low risk score and stable ownership suggest it is a normal infrastructure asset. SOC teams should maintain monitoring for anomalies but no immediate remediation is required.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.

🌍 Geolocation

Country	🇺🇸 United States
Region	ZH
City	Zurich
Timezone	—
Latitude	47.36
Longitude	8.54

🏢 Ownership & Registration

Organization	Microsoft Corporation
ASN	AS8075
Network Name	—
CIDR Block	—
RIR	ARIN
Country	—
Abuse Contact	Available via RDAP

🌐 DNS Intelligence

PTR Record	No PTR
Forward Confirmed	No — PTR hostname does not resolve back to this IP (weak signal)

🔐 DNS Hygiene

Hygiene Score	20% (Poor)
SPF	Not configured
DMARC	Not configured
FCrDNS	Not verified
DNSSEC	Valid
CAA	Not configured

☁️ Network Classification

Infrastructure	Infrastructure / Datacenter
Service Purpose	Firewalled / No Services
Network Tier	Hosting — Infrastructure provider without advanced routing

CloudHosting

🔌 Services & Open Ports

Port	Service	Protocol	Banner
No open ports detected
Closed Ports	22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned)

Server	—
HTTP Title	—

🔐 TLS Certificate

🔒

No certificate

Issued by —

N/A

SANs	None
Valid From	—
Valid Until	—

🎯 Confidence Breakdown

Per-dimension confidence scores based on source diversity and data freshness

Dimension	Score	Sources	Observations
threat	39%	2	5
routing	8%	1	1
services	12%	2	2
ownership	24%	2	3
reputation	26%	1	3
geolocation	19%	2	2
Overall	21%	10	16

Coverage: 6/6 dimensions · Data sufficiency: sufficient

Data Coherence	Consistent (100%)
Attribution	Moderate (50%)
	OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid

📅 Observation Timeline 🔄 Live

First Seen	2026-05-07 23:04:07 UTC
Last Seen	2026-06-27 03:17:22 UTC
Profile Built	2026-06-27 21:23:31 UTC
Data Freshness	Live
Signal Types	18
Total Observations	24

🔍 18 signal types · 24 observations collected

This report is generated from 18+ independent intelligence signals including ownership records, DNS analysis, BGP routing, TLS certificates, port scanning, threat feeds, behavioral fingerprinting, and more.
Full dossier details are available via our API.

{ } JSON API 🔧 Actions API 📧 Enterprise Access

ℹ️ About This Report

All data shown is publicly available network metadata — IP addresses do not reliably identify individuals. Assessments are probabilistic and should not be used as sole basis for access control decisions. To report an issue or request data review, contact admin@ipdebrief.com.

20.203.154.158📋 Copy