20.65.194.130📋 Copy

# IP Intelligence Briefing: 20.65.194.130

## Executive Summary

IP address 20.65.194.130 is a Microsoft Azure CloudCompute infrastructure endpoint with low risk profile (risk score: 25). The IP resolved to stretchoid.com and is hosted within Microsoft's 20.33.0.0/16 network block. While the IP shows minimal direct threat indicators, it maintains presence on one DNS blacklist with high severity.

## Ownership and Classification

• Organization: Microsoft Corporation (ASN 8075)
• Network: MSFT, CIDR Block: 20.33.0.0/16
• Infrastructure Type: CloudCompute
• Cloud Provider: Microsoft Azure
• Country/Region: United States, Texas
• Geolocation: San Antonio, TX (29.43°N, -98.49°W)
• Classification: Cloud hosting environment with no services detected on open ports

## Technical Profile

• DNS Resolution: azpdss7c44ge.stretchoid.com (stretchoid.com)
• PTR Record: Forward confirmed
• DNSBL Status: Listed on 1 of 8 DNS blacklists
• Operator Score: 0.3478 (Basic)
• Route Stability: False
• Open Ports: None detected
• TLS Certificate: None detected
• HTTP Service: None detected

## Neighborhood Analysis (20.65.194.0/24)

The /24 subnet contains 25 total sibling IPs with the following risk distribution:

• High Risk: 0
• Medium Risk: 3
• Low Risk: 19
• Abuse Density: 0.16 (16%)
• Classification: Mostly clean
• Threat Siblings: 4 identified

Notable neighbors include:

• 20.65.194.28 (Risk Score: 65, Authority Score: 60)
• 20.65.194.143 (Risk Score: 65, Authority Score: 60)
• 20.65.194.164 (Risk Score: 40, Authority Score: 60)

## Signal History

Analysis of 24 historical observations indicates:

• Recent geolocation signals consistently map to San Antonio, TX
• DNS blacklist activity detected with maximum severity: high
• Operator scores maintained at Basic level (0.3478)
• Subnet abuse density remained stable at 0.16
• No ownership changes recorded

## Relationship Graph

Seventeen relationships identified, primarily consisting of:

• DNS associations to azpdss7c44ge.stretchoid.com (16 entries)
• Network associations to MSFT infrastructure (multiple entries)

## Threat Indicators

• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Known Campaigns: None
• Threat Feeds: None
• Abuse Confidence Score: Not available

## Recommended Actions

• Allow: Traffic permitted for Microsoft Azure infrastructure
• Monitor: DNSBL listings warrant periodic review
• Block: No immediate blocking recommended
• Firewall Rules: Standard cloud provider allow rules apply

## Intelligence Assessment

20.65.194.130 represents standard Microsoft Azure infrastructure with minimal threat activity. The presence on a single DNS blacklist requires monitoring but does not indicate active malicious use. The subnet demonstrates low overall abuse density (16%) with the majority of siblings classified as low risk. No correlation to known threat campaigns or attacker infrastructure.

Confidence Level: High

Last Updated: 2026-08-05

Status: Active monitoring recommended

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.