161.118.255.41📋 Copy

# IP INTELLIGENCE BRIEFING: 161.118.255.41/32

## Executive Summary

IP address 161.118.255.41 is a cloud-hosted infrastructure endpoint belonging to Oracle Corporation. The IP maintains a low-risk profile with no active threat indicators, though the subnet demonstrates marginal abuse density. RDP service exposure warrants monitoring.

## Infrastructure Profile

• Organization: ORACLE CORPORATION - network administrator
• ASN: 31898 (ORACLEV6-AP)
• CIDR Block: 161.118.0.0/16
• Geolocation: Singapore (SG), Loyang region
• Infrastructure Type: Oracle Cloud Compute (confirmed cloud host)
• Risk Score: 0.0 (Low Risk)
• Provider Score: 0.0
• Authority Score: 0.0

## Network Classification

• Cloud Provider: Yes (Oracle Cloud)
• Hosting Service: Yes
• CDN: No
• VPN/Proxy: No
• Tor Exit Node: No
• Bogon Range: No
• Anycast: No

## Active Services & Exposed Ports

• Port 3389/TCP: RDP (Remote Desktop Protocol) - exposed without additional protection indicators
• No HTTP services detected
• No TLS certificates identified

## Threat Intelligence Indicators

• Abuse Confidence Score: Not assigned
• Blacklist Status: Listed on 8 DNSBLs (max severity: high) per recent observation
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Threat Persistence Days: 0

## Observation History (21 Total Signals)

The IP has been observed since June 2026. Key observations include:

• Cloud infrastructure classification consistently confirmed (Oracle Cloud)
• One observation flagged for listing on 8 threat lists with high severity
• Geographic data shows Singapore consensus (geoPlausible: true)
• No persistent malicious behavior detected (isPersistentlyMalicious: false)

## Network Relationships

• Same Network: 25 relationships identified, all within ORACLEV6-AP network
• No external organizational or hostname relationships detected
• No certificate associations

## Subnet Neighborhood Analysis (161.118.255.0/24)

• Abuse Density: 1 (minimal)
• Classification: Mostly Clean
• Inherited Risk: 2
• Total Siblings: 1
• Active Siblings: 1
• Threat Siblings: 1

## Control Plane Assessment

• Origin ASN: 31898
• BGP Prefix: 161.118.192.0/18
• Route Stability: Unstable (isRouteStable: false)
• Moas: No
• DNSSEC: Valid
• Operator Score: 0.13 (Minimal)
• DNSBL Listed Count: 8

## Recommended Actions

1. Monitor RDP Exposure: Port 3389 is open; ensure appropriate access controls are in place

2. DNSBL Verification: Investigate listing on 8 DNSBLs to determine cause

3. Subnet Correlation: Monitor sibling IPs in 161.118.255.0/24 for coordinated activity

4. Cloud Provider Notification: Consider notifying Oracle Corporation if abuse is confirmed

## Conclusion

The IP 161.118.255.41 operates as a standard Oracle Cloud endpoint with no active malicious indicators. The primary concern is the exposure of RDP services and the IP's presence on multiple DNSBLs. The subnet shows minimal abuse density with one threat sibling. Recommend continued monitoring but no immediate blocking action unless further evidence emerges.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.