130.17.6.40
# INTELLIGENCE BRIEFING: 130.17.6.40/32
Classification: CLEAN / LOW RISK
Date: 2026-07-29
Analyst: IPDebrief Intelligence Team
---
## EXECUTIVE SUMMARY
IP address 130.17.6.40 is a low-risk infrastructure endpoint associated with Fornex Hosting (DE-FORNEX), a German colocation provider. The address exhibits no malicious indicators, no open services, and no threat associations. Recommended action: Monitor; no immediate mitigation required.
---
## OWNERSHIP & INFRASTRUCTURE
| Attribute | Value |
|---|---|
| **ASN** | 44051 |
| **Organization** | Fornex Hosting Ripe coordination |
| **Netname** | DE-FORNEX |
| **CIDR Block** | 130.17.6.0/24 |
| **RIR** | ARIN |
| **Country** | DE (Germany) |
| **Timezone** | Europe/Berlin |
| **Infrastructure Type** | Colocation Hosting |
| **Geolocation Accuracy** | ±600km |
The IP is registered to a legitimate hosting provider with proper RIR registration. The subnet (130.17.6.0/24) shows no abuse density and is classified as clean.
---
## THREAT INTELLIGENCE
| Metric | Value | Assessment |
|---|---|---|
| **Risk Score** | 0 | Low Risk |
| **Abuse Confidence Score** | N/A | No abuse data |
| **Blacklist Count** | 0 | Clean |
| **DNSBL Lists** | 0/8 | Not listed |
| **Tor Exit Node** | No | False |
| **Known Attacker** | No | False |
| **Spam Source** | No | False |
| **Associated Campaigns** | None | 0 matches |
No threat indicators, blacklist entries, or campaign associations detected. The address shows zero threat persistence days and no observed malicious behavior.
---
## NETWORK SERVICES
| Service | Status | Details |
|---|---|---|
| **Open Ports** | None | No services detected |
| **DNS Resolution** | Active | 330058.fornex.cloud |
| **HTTP/HTTPS** | N/A | No web services detected |
| **Email Auth (SPF/DMARC)** | Configured | Both records present |
The endpoint appears firewalled with no active services. DNS infrastructure is properly configured with SPF and DMARC records.
---
## DNS & HOSTNAME RESOLUTION
| Field | Value |
|---|---|
| **PTR Hostname** | 330058.fornex.cloud |
| **Forward Resolution** | 330058.fornex.cloud |
| **Domain** | fornex.cloud |
| **Forward Confirmed** | Yes |
| **Resolution Count** | 1 |
DNS configuration is consistent with hosting infrastructure. No suspicious reverse DNS mismatches.
---
## NETWORK NEIGHBORHOOD ANALYSIS
| Metric | Value |
|---|---|
| **Subnet** | 130.17.6.40/24 |
| **Abuse Density** | 0 |
| **Classification** | Clean |
| **Total Siblings** | 1 |
| **Active Siblings** | 0 |
| **Threat Siblings** | 0 |
No neighboring IPs in the /24 subnet show threat activity. The subnet demonstrates a clean security posture with no inherited risk.
---
## OBSERVATION HISTORY
Total Observations: 19 signals
Recent observations (2026-07-29):
- Geolocation: Germany (confidence: 0.28)
- Network Classification: Colocation hosting (confidence: 0.40)
- Subnet Analysis: Clean classification (confidence: 0.40)
- Service Scan: No open ports detected (confidence: 0.70)
The IP has demonstrated consistent benign behavior across multiple observation cycles. No temporal degradation in reputation or emergence of new threat indicators.
---
## CONTROL PLANE & ROUTING
| Metric | Value |
|---|---|
| **BGP Prefix** | 130.17.6.0/24 |
| **Route Stability** | Unstable |
| **DNSSEC Valid** | Yes |
| **IRR Consistency** | Not evaluated |
| **RPKI State** | Not evaluated |
Routing infrastructure is operational. DNSSEC validation is enabled.
---
## RECOMMENDED ACTIONS
Current Risk Score: 0 / 100
Recommended Firewall Rules: None
Recommended WAF Rules: None
No immediate defensive actions required. The IP exhibits characteristics of legitimate hosting infrastructure with no malicious indicators.
---
## ANALYST NOTES
1. Infrastructure Profile: The IP is part of Fornex Hosting's DE-FORNEX network, a known colocation provider in Germany.
2. Threat Posture: Clean with no associations to known threat actors, campaigns, or malicious infrastructure.
3. Subnet Context: The /24 subnet shows zero abuse density, supporting the assessment of legitimate use.
4. Monitoring Priority: Low. Routine observation is sufficient; no active blocking required.
---
END OF BRIEFING
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Fornex Hosting Ripe coordination |
| ASN | AS44051 |
| Network Name | DE-FORNEX |
| CIDR Block | 130.17.6.0/24 |
| RIR | ARIN |
| Country | DE |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | 330058.fornex.cloud |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | 330058.fornex.cloud |
🔐 DNS Hygiene
| Hygiene Score | 80% (Excellent) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 25% | 1 | 1 |
| routing | 25% | 1 | 1 |
| services | 25% | 1 | 1 |
| ownership | 25% | 1 | 2 |
| reputation | 0% | 0 | 0 |
| geolocation | 0% | 0 | 0 |
| Overall | 16% | 4 | 5 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (70%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-22 13:23:36 UTC |
| Last Seen | 2026-07-29 13:26:04 UTC |
| Profile Built | 2026-07-29 13:35:39 UTC |
| Data Freshness | Live |
| Signal Types | 20 |
| Total Observations | 20 |
Full dossier details are available via our API.