129.146.188.65📋 Copy

# Threat Intelligence Briefing: 129.146.188.65

## Executive Summary

IP address 129.146.188.65 is a Moderate Risk (Score: 50) infrastructure endpoint belonging to Oracle Corporation (ASN 31898, OPC1). The IP resides within Oracle's cloud infrastructure network 129.144.0.0/12, geolocated to Phoenix, Arizona, US. No active malicious campaigns or correlated threats were identified.

## Infrastructure Profile

• Organization: Oracle Corporation (OPC1)
• ASN: 31898
• CIDR: 129.144.0.0/12
• Network Classification: Oracle Cloud Provider
• Infrastructure Type: Single-Service Host
• Geolocation: US/Phoenix, Arizona (2500km accuracy radius)

## Threat Indicators

• DNSBL Listings: 2 of 8 lists flagged
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Known Campaigns: None detected
• Abuse Confidence Score: Not available

## Active Services

• Port 3389 (RDP/tcp): Open, no service banner captured

## Neighborhood Analysis

• Subnet: 129.146.188.65/24
• Abuse Density: 0 (Clean classification)
• Threat Siblings: 0
• Active Siblings: 0
• Classification: Clean subnet environment

## Historical Behavior

• Observations: 19 signal observations recorded
• Recent Activity: Most recent observation on 2026-08-13
• Threat Persistence: 0 days
• Ownership Changes: 0
• Status: Not persistently malicious

The observation history indicates stable routing signals with minimal operator scores (0.1304). No escalation in risk profile observed over the observation period.

## Recommended Actions

1. Allow inbound RDP (3389) traffic if Oracle Cloud infrastructure access is required for authorized operations

2. Monitor for anomalous RDP connection attempts from unexpected source IPs

3. No immediate blocking recommended; the IP is owned by a legitimate cloud provider with clean neighborhood classification

4. Verify any RDP connections to this IP through established Oracle Cloud management channels

## Risk Assessment

The IP presents a Moderate Risk profile primarily due to DNSBL listings and open RDP port. However, given the Oracle Corporation ownership and clean subnet environment, these indicators are likely associated with cloud infrastructure rather than malicious activity. No immediate defensive action required beyond standard monitoring.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.