20.65.194.160📋 Copy

# IP Intelligence Briefing: 20.65.194.160/32

Classification: Low Risk Cloud Infrastructure

Date: 2026-08-11

## Executive Summary

The IP address 20.65.194.160 is classified as a Microsoft Azure cloud compute endpoint with a low risk profile (score: 25/100). The IP resolves to a temporary DNS hostname associated with Stretchoid infrastructure and shows minimal threat indicators despite appearing on one DNS blacklist with high severity.

## Ownership and Infrastructure

## Geolocation

• Country: United States (US)
• Region: Texas (TX)
• City: San Antonio
• Coordinates: 29.43°N, 98.49°W
• Timezone: America/Chicago

## Network Services

• Open Ports: None detected
• Active Services: No services running
• TLS Certificate: Not present
• HTTP Banner: Not present
• Connection Type: Firewalled / No Services

## DNS Analysis

• PTR Hostname: azpdssrcevbe.stretchoid.com
• Forward Resolution: azpdssrcevbe.stretchoid.com
• Forward Confirmed: Yes
• DNSSEC Valid: Yes
• CAA Records: Present

The DNS resolution to a Stretchoid domain indicates this is likely a temporary cloud computing resource.

## Threat Indicators

• Risk Score: 25 (Low Risk)
• Abuse Confidence Score: Not reported
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 1 of 8 lists
• Maximum Severity: High
• Threat Feeds: None detected
• Campaign Matches: None

## Control Plane Data

• BGP Prefix: 20.64.0.0/10
• Origin ASN: 8075
• Route Changes (30d): 0
• Route Stability: False
• Moas (Multiple Origin AS): No
• RPKI State: Not reported
• IRR Consistency: Not reported

## Neighborhood Analysis

The /24 subnet (20.65.194.0/24) contains 27 sibling IPs with the following characteristics:

• Abuse Density: 0.1481 (14.81%)
• Classification: Mostly Clean
• Inherited Risk: 5
• Active Siblings: 24 of 27

Risk distribution in the subnet:

• High Risk: 0
• Medium Risk: 2
• Low Risk: 22

Notable neighbors include 20.65.194.143 (risk score: 65) and 20.65.194.174 (risk score: 50).

## Observation History

The IP has accumulated 25 signal observations over the monitoring period. Key temporal signals include:

• Geolocation: Consistently resolved to San Antonio, TX, US with 80% confidence
• Subnet Classification: Maintained "mostly_clean" classification with inherited risk of 5
• DNS Blacklist: Appeared on 1 of 8 lists with high severity rating
• Ownership Stability: No ownership changes recorded
• Threat Persistence: 0 threat observation days

## Relationship Graph

The IP maintains 31 relationships, predominantly consisting of:

• DNS Associations: 20 relationships to azpdssrcevbe.stretchoid.com
• Network Associations: 11 relationships to MSFT network

## Recommended Actions

• Standard Cloud Infrastructure: No blocking recommended for Microsoft Azure cloud resources
• Monitoring: Monitor for changes in DNS resolution patterns
• List Management: Review blacklist listing rationale given the high severity rating
• Traffic Analysis: Legitimate Azure traffic patterns expected; investigate if traffic deviates from norms

## Conclusion

The IP 20.65.194.160 represents legitimate Microsoft Azure cloud infrastructure with low threat indicators. The single DNS blacklist listing with high severity requires contextual review, as the IP shows no active malicious behavior. The subnet environment is predominantly clean, and the IP exhibits stable ownership and geolocation signals consistent with Microsoft's cloud provider infrastructure.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.