9.205.104.136📋 Copy

# IP Intelligence Briefing: 9.205.104.136

Classification: Moderate Risk (Score: 40/100)

Date: 2026-06-27

Analysis Type: Full Threat Intelligence Assessment

## Executive Summary

IP address 9.205.104.136 is identified as Microsoft Azure cloud infrastructure located in Copenhagen, Denmark (ASN 8075). The IP carries a moderate risk score of 40 with no active threat indicators present. The address shows consistent cloud infrastructure behavior over the observation period, though DNSBL listings indicate prior reputation issues.

## Infrastructure Profile

## Threat Indicators

• Blacklist Status: Listed on 2 of 8 DNSBLs
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Threat Indicators: None
• Associated Campaigns: None

## Network Behavior

• BGP Origin: 9.205.0.0/16
• AS Path: 49788 → 8075
• Route Stability: Stable
• Open Ports: None detected
• Services: None exposed (firewalled)
• DNS Resolution: No PTR records, no forward resolution

## Neighborhood Assessment (9.205.104.0/24)

• Abuse Density: 1 (Profile) / 0 (Neighbors tool)
• Classification: Mostly Clean
• Threat Siblings: 1
• Active Siblings: 1
• Total Siblings: 1

## Historical Observations

21 observations recorded since initial detection. Signals consistently identify the IP as Microsoft Azure cloud infrastructure. Route stability maintained through AS8075 origin. No significant behavioral changes observed over the observation period.

## Recommended Actions

Risk-Based Recommendations: No specific recommendations based on current profile.

Blocking Rules (if required based on organizational policy):

• iptables: `iptables -A INPUT -s 9.205.104.136 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 9.205.104.136 drop`
• nginx: `deny 9.205.104.136;`
• pfSense: `9.205.104.136/32`
• Cloudflare WAF: Block with expression `ip.src eq 9.205.104.136`
• AWS WAF: Include 9.205.104.136/32 in block list

## Intelligence Notes

1. Cloud Infrastructure Context: IP operates within Microsoft Azure cloud environment. Cloud-based IPs often exhibit higher risk scores due to shared infrastructure with potentially abusive activities.

2. DNSBL Listings: The IP appears on 2 of 8 DNSBLs, suggesting prior association with suspicious activity. However, no current threat indicators are present.

3. Moderate Risk Profile: Score of 40 indicates moderate concern. Monitoring recommended for emerging threats.

4. No Active Threats: No open services, no threat indicators, and no known malicious campaigns associated with this IP.

Assessment: This IP represents cloud infrastructure with moderate risk due to DNSBL listings. No immediate threat action required unless organizational policy mandates blocking all Azure IPs or DNSBL-listed addresses. Monitor for behavioral changes.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.