144.126.133.185📋 Copy

# IP Intelligence Briefing: 144.126.133.185

Date: Analysis performed [current date]

Target: 144.126.133.185/32

---

## Executive Summary

IP 144.126.133.185 is a Contabo-hosted virtual machine (VM) in St Louis, MO, US. Overall risk profile is low (Risk Score: 25), with no confirmed malicious indicators. However, geolocation validation failures and a single historical threat observation warrant continued monitoring.

---

## Infrastructure Profile

• Organization: Contabo Inc. (AS40021)
• Network Block: 144.126.128.0/19 (CONTA-48)
• Infrastructure Type: CloudCompute / Hosting
• Hostname: vmi2770364.contaboserver.net
• Open Services: SSH (22/tcp) - OpenSSH_9.6p1 Ubuntu-3ubuntu13.18

---

## Threat Assessment

Current Risk Level: Low Risk (Score: 25/100)

Threat Indicators:

• Blacklist Status: Clean (0 blacklist entries)
• Known Campaigns: None
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Threat Persistence: No (0 days)

Historical Signals: 22 observations recorded. One threat pulse detected on 2026-08-04, though overall threat observation count remains at 1.

---

## Geolocation Anomalies

⚠️ VALIDATION FAILURE DETECTED

• Claimed Location: St Louis, MO, US
• Observed RTT: 43ms average
• Minimum Possible RTT: 142.3ms (for claimed distance of 7115.6km)
• Assessment: Geolocation is implausible. The IP may be spoofing its geographic origin.

---

## Neighborhood Analysis

• Subnet: 144.126.133.185/24
• Abuse Density: 0% (classified as clean)
• Active Siblings: 2/2
• Threat Siblings: 0
• Notable Neighbor: 144.126.133.143 (Risk Score: 25, Authority Score: 60)

---

## Relationships

• Primary Association: DNS records point to Contabo virtual machine infrastructure
• Network: Multiple same-network (CONTA-48) associations
• No Malicious Correlations: No links to known malicious entities

---

## Recommended Actions

SOC Team Actions:

1. Monitor SSH Traffic: The open SSH port (22) is commonly exploited. Consider rate limiting or blocking if not business-critical.

2. Geolocation Awareness: Be aware that reported St Louis location may be inaccurate. Do not rely on this for forensic attribution.

3. Contabo Context: This IP belongs to a VPS hosting provider. Legitimate customers and compromised hosts coexist in this block.

4. Neighbor Watch: Monitor 144.126.133.143 (riskScore: 25) for correlated activity.

5. No Immediate Blocking: Current risk level does not warrant immediate takedown. Use allow-deny rules based on policy.

Firewall Recommendation:

• Consider default-deny with allow rules for expected traffic patterns
• SSH access should be restricted to authorized sources only

---

Classification: LOW RISK - MONITOR

Last Updated: Current analysis cycle

Data Sources: IPDebrief intelligence platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.