161.118.212.147📋 Copy

# IP Intelligence Briefing: 161.118.212.147

Classification: Moderate Risk | Date: July 2026

---

## Executive Summary

IP address 161.118.212.147 presents a moderate risk profile (score: 50/100) with observed infrastructure hosted on Oracle Cloud. The address is located in Singapore but has inconsistent geolocation data. The IP is actively listed on 2 of 8 threat intelligence feeds with high-severity listings and operates SSH and RDP services, indicating potential for lateral movement or unauthorized access vectors.

---

## Technical Profile

Infrastructure:

• Provider: Oracle Cloud
• ASN: 31898
• BGP Prefix: 161.118.192.0/18
• Network Role: Multi-Service Host
• Geolocation: Singapore (SG) – Consensus confirmed with 1 source

Service Footprint:

• Port 22 (TCP): SSH – OpenSSH 9.6p1 Ubuntu-3ubuntu13.18
• Port 3389 (TCP): RDP – Banner unavailable
• DNS Resolution: Forward confirmation failed
• Email Authentication: No SPF or DMARC records detected

Threat Indicators:

• DNSBL Listings: 2 of 8 total lists (high-severity)
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

---

## Temporal Analysis

Observation History (12 total signals):

• Recent Activity: July 29, 2026
• Geolocation Discrepancy: One low-confidence (0.35) observation from India (IN), conflicting with primary Singapore location
• Blacklist Activity: Confirmed presence on 8 threat feeds with 2 high-severity listings
• Network Scanning: Multiple port scans detected (ports 22, 3389, and others)
• DNSSEC: Valid (RRSIG absent)
• Route Stability: Not stable – indicates recent routing changes

---

## Neighborhood Assessment

Subnet Analysis (161.118.212.0/24):

• Abuse Density: 0%
• Active Siblings: 0
• High/Medium Risk IPs: 0
• Neighboring Threats: None detected

The absence of sibling threat activity suggests this IP may operate in isolation within its /24 allocation.

---

## Relationship Graph

No external relationships detected (0 relationships). The IP shows no associations with known organizations, hostnames, certificates, or correlated IP addresses.

---

## Recommended Actions

Immediate:

1. Block inbound RDP (3389): Service exposed without additional authentication controls

2. Monitor SSH (22): Verify legitimate administrative access; consider rate limiting

3. Verify DNSBL Listings: Investigate the 2 high-severity blacklist entries for source and context

Firewall Rules:

```

# Block RDP from this IP (if not authorized)

iptables -A INPUT -p tcp -d 161.118.212.147 --dport 3389 -j DROP

# Rate limit SSH

iptables -A INPUT -p tcp -d 161.118.212.147 --dport 22 -m limit --limit 3/min -j ACCEPT

iptables -A INPUT -p tcp -d 161.118.212.147 --dport 22 -j DROP

```

Long-term:

• Correlate the India geolocation observation with network traffic patterns
• Monitor for changes in route stability and BGP announcements
• Investigate DNSBL listing sources for potential reputation contamination

---

Analyst Notes: The combination of Oracle Cloud infrastructure, RDP exposure, and blacklist presence warrants monitoring. No immediate malicious activity confirmed, but the moderate risk score and service exposure suggest defensive hardening is prudent.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.