109.123.244.125📋 Copy

IP INTELLIGENCE BRIEFING: 109.123.244.125/32

---

CLASSIFICATION: LOW RISK / MONITOR

SUMMARY:

IP 109.123.244.125 is a cloud-hosted web server operated by Contabo (AS51167) in Lauterbourg, Germany (DE). The asset maintains a Low Risk reputation score of 25/100 and demonstrates consistent operational characteristics across 23 historical observations. No malicious threat indicators were identified.

---

INFRASTRUCTURE PROFILE:

• Provider: Contabo (CloudCompute infrastructure)
• ASN: 51167
• Geolocation: Grand Est, DE (coordinates: 51.17°N, 10.45°E)
• Network Classification: Cloud hosting, web server
• DNS Resolution: vmi3319189.contaboserver.net (forward confirmed)
• TLS Certificate: Let's Encrypt (CN=metronanalytic.com)

---

THREAT ASSESSMENT:

• Risk Score: 25 (Low Risk)
• Abuse Confidence Score: Not applicable
• Blacklist Status: Listed on 1 of 8 DNSBL checks
• Known Threat Indicators: None detected
• Campaign Correlation: No associated campaigns or correlated IPs
• Threat Persistence: 0 days (not persistently malicious)

OPEN SERVICES:

• Port 80/tcp (HTTP) - nginx/1.24.0
• Port 443/tcp (HTTPS) - nginx/1.24.0
• Port 22/tcp (SSH) - OpenSSH_9.6p1 Ubuntu

---

HISTORICAL OBSERVATIONS:

23 signal observations collected. Profile shows consistent cloud hosting characteristics with minimal changes over time. Recent observations confirm:

• Provider identification stable (Contabo)
• Infrastructure type: CloudCompute
• No transitions to Tor, VPN, or proxy services
• DNSSEC validation present

---

NETWORK RELATIONSHIPS:

49 relationships identified:

• DNS associations to vmi3319189.contaboserver.net (multiple records)
• Network associations to TT-20221020

SUBNET ANALYSIS (109.123.244.0/24):

• Abuse Density: 0 (mostly_clean classification)
• Neighbor Count: 1 active sibling (109.123.244.82, Risk Score: 30)
• Inherited Risk: 5/100

---

RECOMMENDATIONS:

Firewall/Network Controls:

• No blocking required based on current risk profile
• Monitor DNSBL listing status (currently listed on 1 of 8 feeds)
• SSH port 22 accessible from internet – implement rate limiting if not required

Email Security:

• SPF record present (check validity)
• DMARC record missing – recommend configuration for domain metronanalytic.com

Monitoring:

• Continue standard monitoring for cloud hosting infrastructure
• No immediate threat action required
• Review DNSBL listing periodically

RISK RATING: LOW

ACTION: CONTINUE MONITORING / NO IMMEDIATE ACTION REQUIRED

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.