109.123.246.156📋 Copy

IP INTELLIGENCE BRIEFING: 109.123.246.156/32

Classification: Low Risk / Cloud Infrastructure / Hosting Provider

---

IP Ownership & Classification

• ASN: 51167 (Johannes Selg)
• Organization: Johannes Selg / TT-20221020
• Provider: Contabo (Cloud Compute infrastructure)
• Location: Lauterbourg, Grand Est, Germany (DE)
• IP Type: Cloud-hosted web server (Caddy web server)
• Reverse DNS: vmi1567288.contaboserver.net

Network Services

• Open Ports: TCP/80 (HTTP), TCP/443 (HTTPS), TCP/22 (SSH)
• Infrastructure: Cloud hosting environment
• No CDN, proxy, or VPN indicators

Risk Assessment

• Overall Risk Score: 15 (Low Risk)
• Abuse Confidence: No known malicious activity
• Blacklist Status: Listed on 1 of 8 DNSBLs (minor listing)
• Threat Indicators: None detected
• Tor/Exit Node: No
• Known Attacker: No

Control Plane Analysis

• BGP Prefix: 109.123.240.0/20
• Route Stability: Not stable (1 route change in 30 days)
• RPKI State: Valid
• IRR Consistency: Match
• Operator Score: 0.6522 (Moderate)

Observation History

• Total Signals: 33 observations
• Recent Activity: DNS blacklisting detected (1 list)
• Connection Status: Mixed (connection failures observed)
• No persistent malicious campaign detected

Neighborhood Analysis

• Subnet: 109.123.246.156/24
• Abuse Density: 0 (Clean subnet)
• Sibling IPs: 1 active, 0 with threat indicators
• No correlated IPs in immediate vicinity

Relationship Graph

• Primary DNS Association: vmi1567288.contaboserver.net
• Network Relationships: Multiple associations with network TT-20221020

---

SOC Analyst Recommendations

• No immediate blocking required - IP demonstrates low-risk profile consistent with legitimate cloud hosting infrastructure
• Monitor for any escalation in risk score or appearance on additional blacklists
• Standard web server traffic expected; no anomalous patterns detected
• No firewall rules recommended based on current risk assessment

Intelligence Summary

IP 109.123.246.156 is a low-risk cloud hosting endpoint operated by Contabo in Germany. The IP exhibits normal web server behavior with standard HTTP/HTTPS/SSH services. No active threat indicators or malicious activity patterns detected. The subnet shows clean abuse density with no neighboring risk. This IP represents typical cloud infrastructure hosting and does not require defensive blocking actions.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.