137.23.50.92📋 Copy

# Intelligence Briefing: 137.23.50.92/32

## Executive Summary

IP address 137.23.50.92 is a low-risk Oracle Cloud compute instance operating in the Indian region (Mumbai, IN). The IP carries a risk score of 25 and is classified as a single-service host with RDP (port 3389) exposure. No active threat campaigns were identified, and the IP does not appear in major threat intelligence feeds.

## Network Attribution

• Organization: Oracle Corporation (AS31898)
• Network Name: ORACLE-4
• CIDR Block: 137.23.0.0/16
• Infrastructure Type: Cloud Compute (Oracle Cloud)
• Registration RIR: ARIN

## Geolocation and Routing

• Reported Location: Mumbai, India (IN)
• Geolocation Confidence: 1 source, consensus confirmed
• Routing Stability: Route changes detected within 30-day window; isRouteStable: false
• BGP Prefix: 137.23.32.0/19
• Trace Route: 30 hops, final hop latency 207.9ms, 15 timed-out hops via Comcast transit networks

## Threat Indicators

• Risk Score: 25 (Low Risk)
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Blacklist Count: 0
• DNSBL Status: Listed on 1 of 8 DNSBL lists
• Campaign Correlation: None detected; 0 correlated IPs

## Open Services and DNS

• Open Ports: TCP/3389 (RDP)
• PTR Resolution: None
• Forward DNS: No A records resolved
• Hosted Domains: 0
• TLS/Certificates: None detected

## Historical Signals

Observation history captured 20 signals. Recent activity (2026-08-12) showed:

• Country attribution varied between US and IN across different probes
• Operator score rated as "Minimal" (0.1304)
• Single DNSBL listing detected with high severity rating in one observation
• Alienvault OTX signal flagged has_threats: true in one instance

## Neighborhood Analysis

• Subnet: 137.23.50.0/24
• Abuse Density: 1 (mostly clean classification)
• Active Siblings: 1
• Threat Siblings: 1
• No adjacent IPs in the immediate /24 neighbor set

## Relationships

11 relationships identified, all mapping to the ORACLE-4 network. No external hostname, certificate, or organizational relationships beyond the owning network.

## Recommended Actions

No specific firewall rules or remediation actions were generated. The IP presents as a legitimate Oracle Cloud infrastructure endpoint with minimal risk indicators.

## Assessment

This IP represents standard Oracle Cloud infrastructure with no evidence of malicious activity. The RDP exposure on port 3389 warrants attention but does not indicate compromise. The single DNSBL listing appears isolated. Monitoring the IP for changes in service configuration or threat indicators is recommended, particularly given the route instability flag.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.