20.91.203.45📋 Copy

# IP Intelligence Briefing: 20.91.203.45/32

Classification: Moderate Risk / Cloud Infrastructure

Date: Current Intelligence Cycle

Risk Score: 65/100

---

## Executive Summary

Intellect analyzed IP 20.91.203.45 identifies the address as Microsoft Azure cloud infrastructure located in Gävle, Sweden. While the IP operates within a legitimate cloud provider environment, historical signals indicate proxy activity and multiple DNSBL listings warrant defensive monitoring.

---

## Network Profile

---

## Threat Indicators

Observed Signals:

• Historical proxy check flagged this IP as "Compromised Server" proxy type (confidence: 0.85)
• Multiple DNSBL listings detected across 8 major reputation feeds
• Route stability flagged as unstable in control plane analysis
• No active threat campaigns or correlation to known malicious activity

Negative Indicators:

• Proxy detection signal from proxycheck-io
• DNSBL enumeration across multiple threat feeds

---

## Neighborhood Analysis

Subnet 20.91.203.45/24 analysis reveals:

• Abuse Density: 0%
• Active Siblings: 0
• Threat Siblings: 0
• Risk Distribution: No neighboring IPs identified

No adjacent IP addresses showing malicious activity patterns.

---

## Historical Timeline

Nine observations tracked since August 2026, with recent activity showing:

• August 6, 2026: Geolocation signals confirmed Sweden (confidence: 0.70)
• August 6, 2026: Cloud infrastructure classification confirmed (confidence: 0.90)
• August 6, 2026: Proxy check flagged as compromised server (confidence: 0.85)
• August 6, 2026: Operator score reported as "Minimal" (0.15)

---

## Relationship Graph

No direct relationships detected with:

• Associated hostnames
• Related organizations
• Connected certificates
• Correlated IP addresses

---

## Recommended Actions

Immediate:

• Increase logging verbosity and review recent activity from this IP
• Implement blocking rules based on risk profile

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 20.91.203.45 -j DROP

# nftables

nft add rule inet filter input ip saddr 20.91.203.45 drop

# nginx

deny 20.91.203.45;

# pfSense

20.91.203.45/32

# Cloudflare WAF

{"description":"Block 20.91.203.45 — IPDebrief risk score 65","action":"block","filter":{"expression":"ip.src eq 20.91.203.45"}}

# AWS WAF

{"Addresses":["20.91.203.45/32"],"Description":"IPDebrief risk 65"}

```

---

## Analysis Notes

This IP operates within Microsoft Azure's cloud infrastructure and shows no evidence of persistent malicious activity. The proxy-related historical signal and DNSBL listings suggest the IP may have been repurposed for temporary malicious use or associated with compromised cloud infrastructure. Given the moderate risk score and cloud hosting context, recommended approach is to monitor rather than immediately block, unless correlation with other threat indicators occurs.

Intelligence Confidence: Moderate — based on historical proxy signals and DNSBL presence within legitimate cloud infrastructure.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.