4.223.70.33📋 Copy

INTELLIGENCE BRIEFING: IP ADDRESS 4.223.70.33

Classification: Low Risk / Microsoft Azure Infrastructure

Date: 2026-06-18

1. IDENTIFICATION & OWNERSHIP

The subject IP 4.223.70.33 is assigned to Microsoft Corporation (ASN 8075), operating within the 4.208.0.0/12 BGP prefix. Infrastructure classification confirms Microsoft Azure cloud compute hosting. The IP resolves geographically to Stockholm, Sweden (AB region), with geolocation confidence validated at 56% accuracy (±150km radius).

2. RISK PROFILE

Overall risk score: 25 (Low Risk). Reputation assessment: Low Risk. The IP maintains Microsoft Azure infrastructure characteristics with Microsoft-IIS/10.0 web server banner and ASP.NET application framework indicators. No known malicious campaign associations detected. The control plane indicates 1 DNSBL listing across 8 total lists, though the primary profile shows 0 blacklist counts—suggesting the listing may be context-specific or historical.

3. NETWORK CHARACTERISTICS

• Open services: TCP/80 (HTTP)
• Server banner: Microsoft-IIS/10.0
• TLS certificate: None detected
• HTTP version: 1.1
• Response time: 210ms
• DNSSEC: Valid
• RPKI state: Not applicable

4. THREAT INDICATORS

No active threat indicators observed:

• Not a Tor exit node
• Not identified as known attacker
• Not flagged as spam source
• Zero threat feeds matches
• No associated malware campaigns

5. OBSERVATION HISTORY

Historical analysis reveals 20 signal observations spanning recent monitoring periods. Signal patterns demonstrate consistent Microsoft Azure infrastructure characteristics. Key observations include:

• June 14, 2026: HTTP fingerprinting with Microsoft-IIS/10.0 server signature
• June 14, 2026: Port scanning activity confirming TCP/80 service
• June 14-18, 2026: Geolocation signals consistent with Stockholm, SE
• No observable risk escalation over observation period

6. SUBNET ANALYSIS

Subnet 4.223.70.33/24 shows abuse density of 1 with "mostly_clean" classification. Neighborhood contains 1 total sibling IP address with 1 active sibling. One threat sibling identified within the /24 block, though the subject IP itself maintains low risk profile.

7. RELATIONSHIP MAPPING

The IP maintains multiple "Same Network" relationships to Microsoft (MSFT) organizational assets, confirming infrastructure ownership and network context.

8. RECOMMENDATIONS

Based on risk profile and infrastructure classification, this IP represents legitimate Microsoft Azure cloud infrastructure. No blocking required. SOC analysts should treat as benign, but maintain standard monitoring practices. The single DNSBL listing warrants periodic verification but does not constitute immediate threat.

CONCLUSION: This IP address operates as Microsoft Azure cloud infrastructure with low-risk profile. The threat indicators, risk score of 25, and Microsoft Corporation ownership classification support benign classification. Continue standard monitoring but no defensive action recommended.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.