20.91.139.228📋 Copy

INTEL BRIEFING: IP 20.91.139.228

Classification: Moderate Risk – Cloud Infrastructure

Date: Generated via IPDebrief Intelligence Platform

---

EXECUTIVE SUMMARY

IP 20.91.139.228 is a Microsoft Azure cloud compute address (ASN 8075) presenting a moderate risk profile (65/100). The IP operates within a firewalled Microsoft infrastructure with no active service exposure. While the IP is not flagged as a known attacker or spam source, it exhibits elevated risk indicators including DNSBL listings and unstable routing.

---

OWNERSHIP & INFRASTRUCTURE

• Organization: Microsoft Corporation (MSFT)
• AS Number: 8075
• Network Block: 20.33.0.0/16 (CIDR)
• Infrastructure Type: CloudCompute (Microsoft Azure)
• Geolocation: Stockholm, SE (Sweden) – 2500km radius uncertainty
• Network Role: Firewalled/No Services Detected

---

THREAT ASSESSMENT

• Risk Score: 65/100 (Moderate)
• Abuse Confidence: Not quantified
• Blacklist Status: 0/0 direct blacklists; 3/8 DNSBL listings
• Threat Indicators: None detected
• Known Campaigns: No matches
• Tor Exit Node: No
• Proxy/VPN: No

---

NETWORK BEHAVIOR & SERVICES

• Open Ports: None detected (firewalled)
• HTTP/TLS Services: None
• Certificate Data: None
• Service Purpose: Microsoft Azure Infrastructure
• Route Stability: Unstable (isRouteStable: false)
• BGP Prefix: 20.64.0.0/10

---

OBSERVATION HISTORY

Sixteen signal observations recorded between late July and mid-August 2026. Key findings:

• Operator Score: 0.1304 (Minimal)
• Threat Persistence: 0 days
• Ownership Changes: 0
• Geolocation Signals: Mixed signals detected (Stockholm, SE and Boston, US)
• Classification: Clean subnet with 2 active siblings and 0 threat siblings

---

SUBNET ANALYSIS (20.91.139.0/24)

• Abuse Density: 0
• Subnet Classification: Clean
• Total Siblings: 2
• Active Siblings: 2
• Threat Siblings: 0
• Notable Neighbor: 20.91.139.111 (Risk Score: 50)

---

SECURITY ACTIONS & RECOMMENDATIONS

IMMEDIATE ACTIONS:

1. Monitoring: Increase logging verbosity for this IP. Elevated risk score (65/100) warrants heightened visibility.

2. Blocking: Recommended blocking based on risk profile.

FIREWALL RULES:

```bash

# iptables

iptables -A INPUT -s 20.91.139.228 -j DROP

# nftables

nft add rule inet filter input ip saddr 20.91.139.228 drop

# nginx

deny 20.91.139.228;

# pfSense

20.91.139.228/32

# Cloudflare WAF

ip.src eq 20.91.139.228 → block

# AWS WAF

Addresses: 20.91.139.228/32

```

---

ANALYST NOTES

The IP belongs to legitimate Microsoft Azure infrastructure. Elevated risk score appears to stem from DNSBL listings (3/8) and routing instability rather than malicious activity. However, the moderate risk classification and lack of service transparency warrant defensive monitoring. The subnet (20.91.139.0/24) maintains a clean classification with minimal abuse density, indicating this is an isolated elevated-risk asset within otherwise benign cloud infrastructure.

CORRELATION STATUS: All relationship indicators point to Microsoft network infrastructure (MSFT). No external correlations detected.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.