79.76.59.115
IP Intelligence Briefing: 79.76.59.115/32
Executive Summary
Target 79.76.59.115 is an Oracle Cloud infrastructure host located in Stockholm, Sweden. Despite a moderate risk score of 40, the IP shows no active threat indicators, is not listed in known attacker databases, and operates in a clean subnet neighborhood. The IP warrants monitoring but does not require immediate blocking.
Ownership and Infrastructure
- ASN: 31898 (ORCL-MNT)
- Organization: Oracle Cloud
- Network Block: 79.76.0.0/16 (SE-ORACLE-SE-20070619)
- Geolocation: Stockholm County, Sweden
- Classification: Multi-Service Host (Oracle Cloud infrastructure)
Network Services
- Open Ports: TCP/80 (HTTP), TCP/22 (SSH - OpenSSH 9.6p1 Ubuntu)
- HTTP Behavior: 302 redirect response
- SSL/TLS: No certificates detected
- DNS: No PTR resolution, no forward resolution
Threat Assessment
- Risk Score: 40 (Moderate)
- Threat Indicators: None detected
- Known Attacker: False
- Tor Exit: False
- Spam Source: False
- Blacklist Status: Listed on 2 of 8 DNSBLs
- Campaign Correlation: None
- Threat Persistence: No persistent malicious activity observed
Subnet Analysis
- Subnet: 79.76.59.115/24
- Abuse Density: 0 (Clean)
- Threat Siblings: 0
- Risk Classification: Clean
Observation History
- Total Observations: 18 signals recorded
- Recent Status: Subnet classified as clean in latest observation (2026-07-29)
- Ownership Changes: None observed
- Threat Observation Count: 0
Relationship Analysis
- Associated Networks: SE-ORACLE-SE-20070619 (4 relationship entries)
- No external entity relationships detected beyond Oracle network infrastructure
Recommended Actions
1. Block: Not recommended. No active threat indicators present.
2. Monitor: Recommended. DNSBL listings suggest some reputation concerns that warrant ongoing observation.
3. Investigate: Only if traffic patterns indicate abuse or if the 302 redirect behavior conflicts with expected service patterns.
SOC Notes
The IP represents legitimate Oracle Cloud infrastructure. The moderate risk score appears to be a false positive driven by limited DNSBL coverage rather than actual malicious activity. The clean neighborhood analysis and absence of threat siblings support treating this as trusted infrastructure. Monitor for any changes in threat indicators or subnet abuse patterns.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | ORCL-MNT |
| ASN | AS31898 |
| Network Name | SE-ORACLE-SE-20070619 |
| CIDR Block | 79.76.0.0/16 |
| RIR | RIPE |
| Country | SE |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Multi-Service Host |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 22 | ssh | tcp | |
| Closed Ports | 25, 443, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
| SSH Version | SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.18 |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 35% | 2 | 4 |
| routing | 13% | 1 | 1 |
| services | 30% | 2 | 3 |
| ownership | 27% | 2 | 3 |
| reputation | 15% | 1 | 2 |
| geolocation | 35% | 2 | 3 |
| Overall | 26% | 10 | 16 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-21 06:47:46 UTC |
| Last Seen | 2026-08-12 15:45:17 UTC |
| Profile Built | 2026-08-12 15:57:21 UTC |
| Data Freshness | Live |
| Signal Types | 20 |
| Total Observations | 21 |
Full dossier details are available via our API.