74.249.192.245📋 Copy

# IP Intelligence Briefing: 74.249.192.245/32

Classification: LOW RISK / MONITOR

Date: 2026-06-21

Analyst: Automated IP Intelligence System

---

## Executive Summary

IP address 74.249.192.245 is identified as Microsoft Corporation infrastructure (AS8075) deployed within the Microsoft Azure cloud platform. While the IP operates within legitimate Microsoft network infrastructure, threat intelligence signals indicate limited exposure to abuse feeds and DNS blacklisting activity. Current risk assessment indicates low threat level, though neighborhood monitoring is recommended due to one observed threat sibling within the /24 subnet.

---

## Ownership and Infrastructure

The IP resolves to Microsoft Azure cloud infrastructure. The network role is classified as "Firewalled / No Services" with no open ports detected during scanning operations.

---

## Threat Intelligence Profile

Overall Risk Score: 25/100 (Low Risk)

Threat Indicators

• Abuse Confidence Score: Not calculated
• Known Attacker Status: Not flagged
• Spam Source: Not flagged
• Tor Exit Node: No
• Known Campaigns: None correlated

Blacklist Status

• DNSBL Listings: 1 of 8 total lists flagged
• Maximum Severity: High
• List Details: Multiple blacklist associations detected during observation period

Threat Signal History

Observation record shows 24 historical signals. Key threat indicators identified:

• AlienVault OTX signals detected with 50 pulse associations
• DNS blacklist listing activity observed with high severity classification
• Operator score: 0.3478 (Basic classification)

---

## DNS and Resolution Data

The IP resolves to the stretchoid.com domain with multiple DNS association patterns observed.

---

## Network Neighborhood Analysis

Subnet: 74.249.192.245/24

• Abuse Density: 1 (mostly clean)
• Threat Siblings: 1 detected
• Active Siblings: 1
• Classification: Mostly clean

---

## Control Plane Data

• Route Stability: False
• DNSSEC Valid: True
• Has CAA: True
• Route Changes (30d): 0
• RPKI State: Not available
• IRR Consistency: Not available

---

## Recommended Actions

Current Risk Assessment: Low risk (Score: 25)

Firewall/Security Recommendations:

• No specific firewall rules generated due to low threat classification
• Standard Microsoft Azure traffic should be permitted based on organizational policy
• Monitor for any changes in threat signal patterns

Monitoring Recommendations:

• Continue monitoring DNS blacklist status
• Track neighborhood activity in 74.249.192.0/24 subnet
• Alert on any emergence of new threat indicators

---

## Intelligence Notes

While the IP address operates within legitimate Microsoft Azure infrastructure, the presence of threat pulse signals and DNS blacklist associations warrants continued monitoring. The Microsoft cloud association provides a degree of legitimacy, but the blacklist activity and neighborhood threat sibling indicate this specific address may have been associated with malicious activity at some point. SOC analysts should evaluate in context of organizational threat tolerance and existing Microsoft cloud trust relationships.

No immediate blocking action recommended based on current risk profile.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.