20.64.104.65📋 Copy

# IP Intelligence Briefing: 20.64.104.65/32

Classification: Moderate Risk Cloud Infrastructure Asset

Report Date: Based on current data snapshot

Risk Score: 40/100

## Executive Summary

IP 20.64.104.65 is a Microsoft Azure cloud compute endpoint located in Boston, Massachusetts, US (ASN 8075). The IP presents moderate risk (score 40) due to DNS blacklist associations and route instability, but operates within a predominantly clean subnet environment. No active malicious services or open ports were detected during scanning.

## Technical Profile

## Threat Indicators

DNS Blacklist Activity:

• Listed on 8 DNSBLs with 2 active listings
• Maximum severity rating: High
• DNS entry resolves to: azpdsgkml0gq.stretchoid.com

Network Control Plane:

• Route stability flagged as unstable (isRouteStable: false)
• Origin ASN 8075 with BGP prefix 20.64.0.0/10
• Traceroute completed 30 hops through Comcast transit network

## Observation History

Analysis of 17 signal observations revealed the following pattern:

• Recent Microsoft Corporation ownership confirmed in August 2026 observations
• Geographic signals consistently mapped to Boston, MA region
• DNS blacklist detections appeared in recent observation window
• No evidence of persistent malicious behavior or campaign correlation

## Neighborhood Context

Subnet Analysis: 20.64.104.65/24

• Total sibling IPs: 16
• Abuse density: 0.1765 (17.65%)
• Classification: Mostly clean
• Risk distribution within subnet: 0 high-risk, 3 medium-risk, 13 low-risk IPs

Several neighboring IPs shared similar risk scores (25-40), indicating distributed cloud infrastructure rather than concentrated abuse.

## Relationship Graph

• DNS Association: azpdsgkml0gq.stretchoid.com (hostname)
• No additional organizational or certificate relationships identified

## Recommended Actions

For SOC Operations:

1. Monitor DNS blacklist status on stretchoid.com domain

2. No immediate blocking recommended—IP operates on Microsoft Azure infrastructure with firewalled services

3. Evaluate context of traffic against internal threat intelligence

4. Consider subnet-level monitoring given 17.65% abuse density in /24

Firewall Considerations:

• No explicit block/restrict recommended based on current risk profile
• Cloud infrastructure classification suggests legitimate enterprise traffic patterns
• DNSBL presence warrants monitoring but not definitive malicious indicator

## Conclusion

20.64.104.65 represents a Microsoft Azure cloud endpoint with moderate risk indicators primarily stemming from DNS blacklist associations. The IP shows no evidence of active malicious services, open ports, or known attack campaigns. Contextual assessment within the subnet indicates legitimate cloud infrastructure deployment. SOC teams may monitor DNSBL status but need not initiate blocking actions without additional corroborating threat intelligence.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.