20.91.208.34📋 Copy

## IP Intelligence Briefing: 20.91.208.34/32

Classification: Microsoft Azure Cloud Infrastructure | Risk Score: 65 (Moderate) | Status: Operational

Ownership & Infrastructure

• Organization: Microsoft Corporation (ASN 8075)
• Network: MSFT, 20.33.0.0/16
• Infrastructure: Microsoft Azure CloudCompute environment
• RIR: ARIN (North American registry with European geolocation data)

Geolocation Analysis

• Primary Location: Stockholm, Sweden (SE) - 2,500km accuracy radius
• Network Classification: Cloud hosting provider with firewalled/no services
• Geolocation Signals: Mixed data sources indicate Stockholm, Sweden; some geolocation probes historically suggested US (39.83, -98.58)
• RTT: 102.1ms from probe origin

Threat Assessment

• Risk Score: 65 (Moderate)
• Threat Indicators: None detected
• Known Campaigns: No associations
• Attacker/Spam Source: Negative
• Tor Exit Node: No
• Blacklist Status: Listed on 3 of 8 DNS blacklist feeds checked
• Honeypot Hits: 0
• WAF Violations: 0

Network Behavior

• Open Ports: None detected (firewalled)
• DNS Records: No forward resolution, no PTR records
• TLS/HTTPS: No certificates detected
• HTTP Services: No web services exposed
• Control Plane: 3 DNSBL listings; 0 route changes in 30 days (isRouteStable: false)
• BGP Prefix: 20.64.0.0/10

Neighborhood Analysis (20.91.208.0/24)

• Abuse Density: 0% (Clean)
• Threat Siblings: 0
• Active Siblings: 0
• Classification: Clean subnet

Relationship Graph

• Same Network Links: 5 relationships to MSFT network entities
• External Organizations: None
• Hostnames/Certificates: None detected

Signal History

• Observation Count: 17 signals recorded
• Recent Activity: July 30, 2026 observations
• Threat Persistence: 0 days
• Ownership Changes: 0
• Status: No persistent malicious activity detected

---

Security Recommendations

SOC Analyst Actions:

1. Allow with Monitoring: IP is legitimate Microsoft Azure infrastructure with no active threats

2. DNSBL Investigation: Investigate 3 DNS blacklist listings for potential false positives or legitimate enterprise mail flow patterns

3. Baseline Traffic: Establish baseline for Azure traffic patterns from this subnet

4. Geolocation Discrepancy: Monitor for any actual service activity inconsistent with Stockholm, Sweden location data

5. No Immediate Action Required: No firewall blocking recommended

Threat Indicators: None actionable

Confidence Level: High - Microsoft-owned cloud infrastructure with clean neighborhood and no active threat signatures

---

*Intelligence compiled from IPDebrief multi-source analysis. All data points verified against control plane and behavioral indicators.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.