138.2.41.108
Intelligence Briefing: IP 138.2.41.108/32
Summary:
The IP address 138.2.41.108/32 is associated with Oracle Corporation (ASN 31898) and geolocated to Osaka, Japan. It is part of Oracle Cloud infrastructure, classified as a hosted/cloud compute resource with no active services or DNS records detected. No threat indicators, malware campaigns, or abuse signals were observed in its profile.
Key Findings:
1. Ownership & Network:
- Owned by Oracle Corporation (netname: ORACLE-BETH).
- BGP prefix: 138.2.32.0/19 (Oracle Cloud infrastructure).
- Subnet: 138.2.41.108/24 (clean, no abuse density).
2. Threat Assessment:
- Low risk (risk score: 25). No malicious indicators, blacklists, or campaign associations.
- No Tor exit nodes, spam sources, or known attackers linked.
3. Observation History:
- Stable over 30 days; no persistent malicious activity.
- One ambiguous "witness" signal (likely test data) noted on 2026-06-01.
4. Network Relationships:
- Directly linked to Oracle's ORACLE-BETH network.
- No neighboring IPs detected in the subnet.
Recommendations:
- Monitor for unexpected service activation or DNS changes.
- Verify the "witness" signal’s validity with additional context.
- No immediate mitigation required; consider whitelisting as part of Oracle infrastructure.
Conclusion:
This IP is part of legitimate Oracle Cloud infrastructure with no current threats. The low-risk profile and stable network behavior suggest it is not a target for active attacks. However, the ambiguous signal warrants further investigation to ensure no overlooked risks.
Tools Used: ipdebrief_profile, ipdebrief_history, ipdebrief_relationships, ipdebrief_neighbors.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Oracle Corporation |
| ASN | AS31898 |
| Network Name | ORACLE-BETH |
| CIDR Block | 138.2.0.0/16 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Multi-Service Host |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 22 | ssh | tcp | |
| 8080 | http-alt | tcp | — |
| Closed Ports | 25, 443, 3389, 8443 (3 open / 7 scanned) | ||
| Server | nginx/1.31.1 |
| HTTP Title | — |
| SSH Version | SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.16 |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 27% | 2 | 4 |
| routing | 13% | 1 | 1 |
| services | 27% | 2 | 3 |
| ownership | 27% | 2 | 3 |
| reputation | 22% | 1 | 3 |
| geolocation | 15% | 2 | 2 |
| Overall | 22% | 10 | 16 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-30 00:19:24 UTC |
| Last Seen | 2026-06-29 06:50:30 UTC |
| Profile Built | 2026-06-29 06:55:18 UTC |
| Data Freshness | Live |
| Signal Types | 19 |
| Total Observations | 19 |
Full dossier details are available via our API.