161.118.223.66📋 Copy

INTELLIGENCE BRIEFING: 161.118.223.66/32

Classification: Moderate Risk — Oracle Cloud Infrastructure Host

Analysis Date: Current

Risk Score: 50/100

---

**Ownership & Network Attribution**

The IP address belongs to ORACLE CORPORATION (ASN 31898), registered under the ORACLEV6-AP network (161.118.0.0/16). Geolocation data indicates the host is situated in Singapore (SG), specifically the Loyang region. The infrastructure is classified as Oracle Cloud with single-service host designation.

**Observed Services**

Active port scan data reveals SSH (port 22/tcp) running OpenSSH 9.6p1 Ubuntu-3ubuntu13.18. No HTTP services, TLS certificates, or web banners were detected. DNS PTR resolution and forward resolution are absent.

**Threat Intelligence Assessment**

• Threat Indicators: None identified
• Blacklist Status: Listed on 2 of 8 DNSBLs
• Abuse Confidence: Not reported
• Known Attacker: No
• Spam Source: No
• Tor Exit/Proxy: No
• Campaign Correlation: No matches (certMatches: 0, correlatedIps: 0)
• Persistence: 0 threat observation days; not persistently malicious

**Neighborhood Analysis**

Subnet 161.118.223.66/24 shows:

• Abuse Density: 0 (clean classification)
• Sibling IPs: 1 active neighbor (161.118.223.72)
• Neighbor Risk: Low (risk score 25)
• Threat Siblings: 0

**Control Plane Observations**

• Route Stability: Unstable (isRouteStable: false)
• Recent Route Changes: Detected in last 30 days
• RPKI State: Inconsistent
• DNSSEC: Valid

**Temporal History**

19 historical observations recorded. The most recent observation (2026-08-06) shows minimal operator scoring (0.1304). No ownership changes or escalating threat patterns observed.

**Recommended Security Actions**

Despite moderate risk scoring, the IP presents limited malicious indicators. However, based on risk profile:

**Operational Notes**

This IP is associated with legitimate Oracle Cloud infrastructure but shows minor DNSBL listings and unstable routing characteristics. The moderate risk score warrants monitoring but does not indicate active malicious activity. Recommend continued observation for any changes in service banners or threat indicators.

---

Analyst Signature: IPDebrief Intelligence Platform

Confidence Level: Moderate

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.