# 20.65.194.48 — IP Intelligence Summary

20.65.194.48 is an IPv4 address operated by Microsoft Corporation (AS8075), geolocated to San Antonio, United States. It belongs to datacenter or hosting infrastructure with reverse DNS name azpdssaj95k7.stretchoid.com. As of October 6, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/20.65.194.48
- Last updated: 2026-10-06

## Ownership

- Organization: Microsoft Corporation
- Network name: MSFT
- Allocated block: 20.33.0.0/16
- ASN: AS8075 (https://ipdebrief.com/asn/8075)
- Regional registry: ARIN
- Cloud / hosting provider: Microsoft Azure

## Location

- City: San Antonio
- Region: TX
- Country: United States
- Time zone: America/Chicago

## Network classification

- Infrastructure type: CloudCompute
- Datacenter / hosting: yes
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- azpdssaj95k7.stretchoid.com
- Forward-confirmed: yes

## Analyst narrative

\# IP Intelligence Briefing: 20.65.194.48

\## Executive Summary

IP address 20.65.194.48 is classified as **Low Risk** (Risk Score: 25) with no active threat indicators. The IP belongs to Microsoft Corporation's Azure infrastructure, operates as a cloud endpoint with no detected services, and resides within a predominantly clean subnet. No immediate defensive action required.

\## Ownership and Network Context

\- **Organization:** Microsoft Corporation (MSFT)

\- **ASN:** 8075

\- **CIDR Block:** 20.33.0.0/16

\- **Geolocation:** United States (Texas, San Antonio)

\- **Infrastructure Type:** Microsoft Azure Cloud

\- **Connection Classification:** Firewall/No Services

\## Threat Assessment

**Risk Level:** LOW

\- **Overall Risk Score:** 25

\- **Abuse Confidence:** Not applicable

\- **Blacklist Status:** 0 blacklists (single DNSBL listing among 8 total)

\- **Known Attacker:** No

\- **Spam Source:** No

\- **Tor Exit Node:** No

**Threat Indicators:** None detected. No known campaigns, threat feeds, or reputation sources flagged.

\## Network Neighborhood Analysis (20.65.194.0/24)

\- **Abuse Density:** 0.1739 (Low)

\- **Classification:** Mostly Clean

\- **Total Siblings:** 23

\- **Active Siblings:** 12

\- **Threat Siblings:** 4

\- **Risk Distribution:** 0 High, 3 Medium, 19 Low

The subnet maintains a low-abuse profile consistent with Microsoft Azure cloud infrastructure.

\## Observations and Historical Behavior

**Observation Count:** 23 signals recorded

\- **Threat Persistence:** 0 days (no persistent malicious activity)

\- **Ownership Changes:** 0

\- **Route Stability:** Route changes detected over 30-day period

Recent signal history indicates consistent low-risk classification with no escalation in threat indicators over the observation window.

\## DNS and Service Profile

\- **PTR Record:** azpdssaj95k7.stretchoid.com

\- **Forward Resolution:** Confirmed

\- **Open Ports:** None detected

\- **TLS Certificate:** None

\- **HTTP Banner:** None

DNS records resolve to stretchoid.com domain, which appears to be Azure's internal service naming convention.

\## Control Plane Data

\- **BGP Prefix:** 20.64.0.0/10

\- **RPKI State:** Not validated

\- **DNSSEC:** Valid

\- **Route Stability:** Unstable (routeChanges30d: 0)

\## Recommendations for SOC Analysts

1. **No Immediate Blocking:** Low-risk score and Microsoft Azure ownership suggest legitimate infrastructure

2. **Traffic Monitoring:** Acceptable for inbound/outbound traffic without blocking

3. **Subnet Context:** Consider the broader /24 subnet context when evaluating related traffic

4. **Change Detection:** Monitor for any shift in risk profile or appearance of threat indicators

\## Conclusion

IP 20.65.194.48 represents standard Microsoft Azure cloud infrastructure with no malicious activity detected. The low risk score, clean neighborhood profile, and absence of threat indicators support continued traffic acceptance. No firewall rules or blocking measures recommended at this time.

## Nearby addresses

- 20.65.194.2 (https://ipdebrief.com/20.65.194.2)
- 20.65.194.16 (https://ipdebrief.com/20.65.194.16)
- 20.65.194.28 (https://ipdebrief.com/20.65.194.28)
- 20.65.194.29 (https://ipdebrief.com/20.65.194.29)
- 20.65.194.42 (https://ipdebrief.com/20.65.194.42)
- 20.65.194.46 (https://ipdebrief.com/20.65.194.46)
- 20.65.194.58 (https://ipdebrief.com/20.65.194.58)
- 20.65.194.59 (https://ipdebrief.com/20.65.194.59)
- 20.65.194.60 (https://ipdebrief.com/20.65.194.60)
- 20.65.194.61 (https://ipdebrief.com/20.65.194.61)
- 20.65.194.76 (https://ipdebrief.com/20.65.194.76)
- 20.65.194.81 (https://ipdebrief.com/20.65.194.81)

---

Source: IPDebrief, "20.65.194.48 IP intelligence", https://ipdebrief.com/20.65.194.48, updated 2026-10-06. Assessments are probabilistic.