# 20.65.194.42 — IP Intelligence Summary

20.65.194.42 is an IPv4 address operated by Microsoft Corporation (AS8075), geolocated to San Antonio, United States. It belongs to datacenter or hosting infrastructure with reverse DNS name azpdssugh70r.stretchoid.com. As of October 6, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/20.65.194.42
- Last updated: 2026-10-06

## Ownership

- Organization: Microsoft Corporation
- Network name: MSFT
- Allocated block: 20.33.0.0/16
- ASN: AS8075 (https://ipdebrief.com/asn/8075)
- Regional registry: ARIN
- Cloud / hosting provider: Microsoft Azure

## Location

- City: San Antonio
- Region: TX
- Country: United States
- Time zone: America/Chicago

## Network classification

- Infrastructure type: CloudCompute
- Datacenter / hosting: yes
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- azpdssugh70r.stretchoid.com
- Forward-confirmed: yes

## Analyst narrative

\# IP Intelligence Briefing: 20.65.194.42/32

**Date:** 2026-08-12

**Classification:** Low Risk Cloud Infrastructure

\---

\## Executive Summary

IP 20.65.194.42 is identified as Microsoft Azure cloud infrastructure with an overall Low Risk profile. The IP demonstrates cloud compute characteristics with no active services detected. While currently classified as low risk, the IP has been observed on 1 of 8 DNS blacklists with high severity severity in recent observations.

\## Technical Profile

| Attribute | Value |

|-----------|-------|

| **IP Address** | 20.65.194.42/32 |

| **Risk Score** | 25 (Low Risk) |

| **Organization** | Microsoft Corporation (ASN 8075) |

| **Network** | MSFT, 20.33.0.0/16 |

| **Geolocation** | San Antonio, TX, US |

| **Infrastructure** | Microsoft Azure Cloud Compute |

| **Status** | Firewalled / No Services |

\## Threat Assessment

\### Current Threat Indicators

\- **DNS Blacklist Status:** Listed on 1 of 8 threat feeds with high severity (observed 2026-08-12)

\- **Threat Feeds:** No known campaign associations

\- **Known Attacker:** False

\- **Spam Source:** False

\- **Tor Exit Node:** False

\### Historical Observations

Analysis of 23 historical observations indicates:

\- Consistent cloud infrastructure classification (Microsoft Azure)

\- Subnet abuse density: 0.16 (mostly clean)

\- Inherited risk from subnet: 6/100

\- No persistent malicious behavior detected

\## Network Relationships

\### DNS Associations

\- **Hostname:** azpdssugh70r.stretchoid.com

\- **Domain:** stretchoid.com

\- **Note:** No SPF or DMARC records configured for this domain

\### Subnet Context

The /24 subnet (20.65.194.0/24) contains 26 total neighbors:

\- **Risk Distribution:** 0 high, 1 medium, 23 low

\- **Abuse Density:** 0.16

\- **Notable Neighbor:** 20.65.194.174 (Risk Score: 50)

\- **Common Authority Score:** 60 across neighbors

\## SOC Analyst Recommendations

\### Immediate Actions

1. **Monitor DNSBL listings** - IP appears on 1 of 8 blacklists; investigate source of listing

2. **Verify legitimate Azure usage** - Confirm expected Microsoft Azure traffic patterns

3. **Review DNS configuration** - azpdssugh70r.stretchoid.com lacks email authentication (SPF/DMARC)

\### Firewall/Network Rules

\- No specific blocking recommended (low risk)

\- Monitor for service anomalies (currently no open ports detected)

\- Block only if DNSBL listing source is confirmed malicious

\### Long-term Considerations

\- Subnet-level monitoring recommended due to 4 threat siblings in /24

\- Investigate 20.65.194.174 (risk score 50) for potential correlation

\- Track stretchoid.com domain reputation independently

\---

**Assessment:** This IP represents legitimate Microsoft Azure infrastructure with elevated risk due to a single DNS blacklist listing. No immediate blocking recommended, but maintain monitoring on the blacklist status and correlate with subnet-level threats.

## Nearby addresses

- 20.65.194.2 (https://ipdebrief.com/20.65.194.2)
- 20.65.194.16 (https://ipdebrief.com/20.65.194.16)
- 20.65.194.28 (https://ipdebrief.com/20.65.194.28)
- 20.65.194.29 (https://ipdebrief.com/20.65.194.29)
- 20.65.194.46 (https://ipdebrief.com/20.65.194.46)
- 20.65.194.48 (https://ipdebrief.com/20.65.194.48)
- 20.65.194.58 (https://ipdebrief.com/20.65.194.58)
- 20.65.194.59 (https://ipdebrief.com/20.65.194.59)
- 20.65.194.60 (https://ipdebrief.com/20.65.194.60)
- 20.65.194.61 (https://ipdebrief.com/20.65.194.61)
- 20.65.194.76 (https://ipdebrief.com/20.65.194.76)
- 20.65.194.81 (https://ipdebrief.com/20.65.194.81)

---

Source: IPDebrief, "20.65.194.42 IP intelligence", https://ipdebrief.com/20.65.194.42, updated 2026-10-06. Assessments are probabilistic.