4.246.61.185📋 Copy

# IP Intelligence Briefing: 4.246.61.185

## Executive Summary

IP address 4.246.61.185 is a Microsoft Azure cloud infrastructure host classified as Moderate Risk (risk score: 50). The IP belongs to Microsoft Corporation (ASN 8075) and is located in the United States (Washington). While the subnet shows low abuse density and clean classification, the IP is listed on 2 out of 8 DNS blocklists and exposes SSH on port 22.

## Infrastructure Profile

• Organization: Microsoft Corporation
• ASN: AS8075
• Network Role: CloudCompute (Microsoft Azure)
• Geolocation: US, WA (Quincy)
• Infrastructure Type: Cloud hosting with single-service host purpose
• Classification: Cloud infrastructure, not residential, proxy, VPN, or Tor

## Threat Indicators

• Risk Score: 50 (Moderate Risk)
• DNSBL Status: Listed on 2 of 8 DNS blacklists
• Known Campaigns: None detected
• Threat Feeds: No active threat feed matches
• Abuse Confidence Score: Not calculated
• Known Attacker/Spam Source: Not flagged
• Tor Exit Node: No

## Network Services

• Open Ports: 22/TCP (SSH - OpenSSH_8.9p1 Ubuntu-3ubuntu0.15)
• TLS Certificates: None detected
• HTTP Services: None detected
• DNS Records: No reverse resolution, no hosted domains

## Observation History

Analysis of 20 recent observations reveals consistent Microsoft Azure cloud infrastructure classification. The IP has demonstrated stability in its network role classification with recent signals from June 2026. Operator score of 0.3478 indicates basic routing characteristics.

## Neighborhood Analysis

• Subnet: 4.246.61.0/24
• Abuse Density: 0 (low)
• Classification: Mostly clean
• Threat Siblings: 1
• Active Siblings: 1
• Total Siblings: 1

## Relationships

The IP shows 26 relationships, all categorized as "Same Network" pointing to Microsoft (MSFT), confirming this is part of Microsoft's corporate network infrastructure.

## Recommended Actions

Based on the risk profile and DNSBL listings, the following defensive measures are recommended:

## Analyst Notes

This IP presents a moderate risk profile due to DNSBL listings despite being part of Microsoft Azure infrastructure. The SSH service exposure on port 22 could indicate potential compromise or unauthorized access attempts. The 2 DNSBL listings suggest the IP may have been involved in prior malicious activity or has been associated with spam sources. Recommend blocking inbound traffic while monitoring for any outbound connections that might indicate active compromise. The subnet-level abuse density remains low, suggesting this is an isolated incident rather than broader subnet compromise.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.