92.5.66.49📋 Copy

# IP Intelligence Briefing: 92.5.66.49/32

## Executive Summary

IP 92.5.66.49 is a moderate-risk (55/100) Oracle Cloud infrastructure endpoint located in Birmingham, England. The address shows elevated risk scoring with active DNSBL listings and should be monitored for malicious activity.

## Infrastructure Profile

• Owner/Provider: Oracle Cloud (ASN 31898, ORCL-MNT)
• CIDR Block: 92.0.0.0/13
• Geolocation: Birmingham, England (GB), Europe/London timezone
• Infrastructure Type: Multi-service cloud host
• Network Classification: Valid RPKI, not bogon

## Risk Assessment

The IP maintains a moderate risk score of 55/100. Control plane analysis indicates route instability with 1 route change within the past 30 days. The address appears on 3 of 8 DNSBL lists with high severity severity ratings in recent observations.

## Observed Services

• Port 22/tcp: SSH (OpenSSH_9.6p1 Ubuntu-3ubuntu13.18)
• Port 8080/tcp: HTTP-alt (SimpleHTTP/0.6 Python/3.12.3)

No TLS certificates, email authentication (SPF/DMARC), or hosted domains were resolved.

## Threat Indicators

• DNSBL Listed: Yes (3 of 8 lists)
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Campaign Association: None identified

## Neighborhood Analysis

The /24 subnet (92.5.66.49/24) shows clean classification with 0 abuse density and no sibling IPs flagged for malicious activity.

## Historical Observations

Analysis of 42 observations indicates recent DNSBL activity with maximum severity rated as "high" during August 2026. Operator score maintained at 0.4348 with "Basic" classification across multiple signals.

## Recommended Actions

Immediate

• Increase logging verbosity and review recent activity from this IP address
• Implement blocking rules across perimeter security devices

Firewall Rules

```bash

# iptables

iptables -A INPUT -s 92.5.66.49 -j DROP

# nftables

nft add rule inet filter input ip saddr 92.5.66.49 drop

# Cloudflare WAF

ip.src eq 92.5.66.49 → BLOCK

# AWS WAF

92.5.66.49/32 → BLOCK

```

## Intelligence Note

While the IP is registered to Oracle Cloud infrastructure and shows no known association with active campaigns, the elevated risk score combined with DNSBL presence warrants defensive measures. The clean subnet neighborhood suggests this may be an isolated compromised or misconfigured cloud endpoint rather than part of a larger botnet. Continuous monitoring is recommended.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.