109.123.248.34📋 Copy

IP INTELLIGENCE BRIEFING: 109.123.248.34/32

Executive Summary:

The IP address 109.123.248.34 operates as a low-risk cloud compute instance hosted by Contabo (ASN 51167). The system exhibits clean classification with no observed malicious activity across threat feeds. The IP resolves to a virtual machine hostname (vmi2940225.contaboserver.net) within the 109.123.240.0/20 network block.

Risk Assessment:

• Overall Risk Score: 25/100 (Low Risk)
• Reputation: Low Risk
• Abuse Confidence: No known attacker indicators
• Blacklist Status: Not listed on threat feeds; minimal DNSBL presence (1 of 8 total lists)
• Persistent Malicious Behavior: None detected
• Threat Persistence: 0 days observed

Ownership and Infrastructure:

• Organization: Johannes Selg
• Network Name: TT-20221020
• Infrastructure Type: Cloud Compute (Contabo)
• Hosting Classification: Yes
• Registration: ARIN registry
• Geographic Location: Germany (DE), Berlin timezone

Network Services and Fingerprint:

• Open Ports: TCP/80 (HTTP), TCP/443 (HTTPS), TCP/22 (SSH)
• Web Server: Apache
• SSL Certificate: Let's Encrypt, issued for mininghub.biz
• DNS PTR: vmi2940225.contaboserver.net
• HTTP Title: Not populated
• Server Banner: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.16

Security Posture:

• DNSSEC: Valid
• HSTS: Not enabled
• CSP: Not configured
• HTTP/2: Enabled
• Domain Authentication: DMARC configured, SPF not configured

Observation History:

Analysis of 21 historical observations indicates consistent low-risk behavior. The IP maintained clean classification across all observation periods with no emergence of threat indicators. Geo-validation confirmed plausible origin at 401.9km distance with 193.6ms average RTT. No routing anomalies or BGP instability detected.

Network Neighborhood:

The /24 subnet (109.123.248.0/24) demonstrates zero abuse density with clean classification. Two active sibling IPs exist within the subnet. One neighbor (109.123.248.145) shows identical risk scoring (25) with elevated authority score (60). No threat siblings detected.

Relationship Graph:

Fifteen relationship entries identified, primarily DNS associations pointing to vmi2940225.contaboserver.net and network associations to TT-20221020. No external organizational or certificate correlations beyond the immediate infrastructure.

Recommendations:

No immediate blocking or mitigation actions required. The IP demonstrates benign cloud hosting behavior. Continued monitoring recommended for emerging threat campaigns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.