20.55.35.128📋 Copy

# IP Intelligence Briefing: 20.55.35.128

## Executive Summary

IP address 20.55.35.128 is Microsoft Corporation cloud infrastructure with a low-risk profile (risk score: 25). The IP operates within Microsoft Azure cloud compute environment in Virginia, US. While current threat indicators show minimal risk, historical data includes one observation classifying the IP as a compromised server proxy type.

## Infrastructure Profile

• Organization: Microsoft Corporation (AS8075)
• Network: 20.33.0.0/16 (MSFT)
• Geolocation: Virginia, US (coordinates: 37.37, -79.46)
• Infrastructure Type: CloudCompute (Microsoft Azure)
• Risk Score: 25 (Low Risk)
• Abuse Confidence Score: Not available
• DNS Resolution: azpdesah0azl.stretchoid.com (forward confirmed)

## Threat Assessment

Current Status: Low risk with no active threat indicators

• Blacklist count: 0
• Tor exit node: No
• Known attacker: No
• Spam source: No
• Known campaigns: None detected

Historical Signals: Analysis of 23 observations revealed one signal (2026-08-13) identifying the IP as a "Compromised Server" proxy type with confidence 0.85. Subsequent profiling shows current classification as Microsoft Azure with no active threat indicators.

## Network Context

Subnet Analysis (20.55.35.0/24):

• Abuse density: 0 (clean)
• Total siblings: 2
• Active siblings: 1
• Threat siblings: 0

Neighbor IP: 20.55.35.217 (risk score: 25, authority score: 60)

## Service Exposure

• Open ports: None detected
• TLS certificates: None
• HTTP services: None
• Connection type: Firewalled/No services exposed

## Control Plane Data

• BGP prefix: 20.48.0.0/12
• RPKI state: Not available
• Route stability: Unstable (0 route changes in 30 days)
• DNSSEC validation: Valid
• DNSBL listed count: 1 (of 8 total lists)

## Intelligence Narrative

IP 20.55.35.128 operates as Microsoft Azure cloud infrastructure with standard cloud compute characteristics. The IP maintains low-risk posture with minimal threat indicators. Historical observation flagged the IP as a compromised proxy server in August 2026, though current profiling indicates legitimate Microsoft infrastructure operations. The IP resolves to Microsoft-owned stretchoid.com domain with no active services exposed.

Recommended Actions: Monitor as legitimate cloud infrastructure. No immediate blocking recommended. Maintain awareness of historical proxy-type classification in threat correlation workflows.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.