20.251.58.190
IP INTELLIGENCE BRIEFING: 20.251.58.190/32
Classification: Moderate Risk
Status: Legitimate Cloud Infrastructure
OWNERSHIP & INFRASTRUCTURE
IP 20.251.58.190 belongs to Microsoft Corporation (ASN 8075), operating within the Microsoft Azure cloud infrastructure. The address is assigned to netname MSFT within the 20.192.0.0/10 CIDR block, registered through ARIN. Geolocation analysis places the IP in Oslo, Norway (NO), with geo-validation confidence confirmed. The infrastructure type is classified as CloudCompute with hosting services enabled.
RISK ASSESSMENT
The IP presents a moderate risk score of 65. No known attacker indicators, Tor exit node status, or spam source designation. Blacklist count is zero with no known campaign affiliations. The IP is not flagged as persistently malicious. Control plane data indicates the IP is listed on 3 of 8 DNSBL lists, with an operator score of 0.1304 (Minimal risk level).
NETWORK BEHAVIOR
No open ports or active services detected. The IP has no reverse DNS PTR records and forward resolution is not confirmed. DNSSEC validation is active. The neighborhood analysis shows 0 abuse density with classification "clean," and the /24 subnet contains no neighbor IPs.
HISTORICAL OBSERVATIONS
Analysis of 22 historical observations reveals consistent infrastructure behavior. The most recent activity (2026-08-12) shows DNSSEC signals, subnet classification as "clean" with 0 abuse density, and operator scores maintaining "Minimal" risk levels. No threat persistence days recorded.
RELATIONSHIP ANALYSIS
Relationship mapping indicates all 9 connections point to the MSFT network entity. No certificate associations or related hostnames detected beyond network-level relationships.
SOC ANALYST RECOMMENDATIONS
Based on the risk profile, no immediate blocking actions are recommended. The IP represents legitimate Microsoft Azure infrastructure with no active threat indicators. Monitor for service enumeration activity. Standard cloud infrastructure logging applies.
SUMMARY
IP 20.251.58.190 is Microsoft Azure cloud infrastructure in Oslo, Norway with moderate risk classification. No active malicious indicators detected. Normal cloud infrastructure behavior observed across historical data.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Microsoft Corporation |
| ASN | AS8075 |
| Network Name | MSFT |
| CIDR Block | 20.192.0.0/10 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Single-Service Host |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| Closed Ports | 22, 25, 443, 3389, 8080, 8443 (1 open / 7 scanned) | ||
| Server | nginx/1.31.2 |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 35% | 2 | 4 |
| routing | 13% | 1 | 1 |
| services | 19% | 2 | 2 |
| ownership | 27% | 2 | 3 |
| reputation | 17% | 1 | 2 |
| geolocation | 27% | 2 | 3 |
| Overall | 23% | 10 | 15 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-26 15:20:29 UTC |
| Last Seen | 2026-08-12 20:38:08 UTC |
| Profile Built | 2026-08-12 20:55:37 UTC |
| Data Freshness | Live |
| Signal Types | 20 |
| Total Observations | 21 |
Full dossier details are available via our API.