IP Intelligence Briefing: 144.126.147.123
*Generated from IPDebrief data*
---
**Risk Assessment**
- Risk Score: 59 (Moderate Risk)
- Threat Indicators:
- Tor exit node activity detected
- Blacklisted in 1 source
- No known attacker or spam associations
- Network Role: Tor exit node (classified as "Provider: Tor Exit Nodes")
- Geolocation:
- Listed as St Louis, MO, US (geoPlausible: False)
- RTT anomalies suggest potential misattribution
---
**Observation History**
- Recent Activity:
- Tor exit node signals observed on 2026-06-16 (confidence: 0.95)
- 24 pulse alerts linked to Tor-related threats
- DNS resolution linked to `vmi3150148.contaboserver.net`
- Network Stability:
- BGP route stability: Stable (no recent changes)
- DNSSEC validation: Valid
---
**Relationships**
- Network Affiliation:
- Owned by Contabo Inc. (AS40021, CONTA-48)
- Subnet: `144.126.128.0/19`
- DNS Associations:
- PTR hostname: `vmi3150148.contaboserver.net`
- DMARC record present but no SPF alignment
- Threat Correlation:
- No direct campaign links, but Tor exit node activity raises suspicion
---
**Neighborhood Analysis**
- Subnet: `144.126.147.123/24`
- Abuse Density: 0 (no risky neighbors detected)
- Subnet Classification: "Mostly clean"
---
**Actionable Intelligence**
1. Monitor Tor Traffic: The IP is a Tor exit node, which could be used for anonymized malicious activity. Investigate outbound traffic patterns.
2. Verify Geolocation: The geoPlausible flag is false, suggesting potential misattribution. Cross-check with other geolocation sources.
3. Check DNS Records: The hostname `vmi3150148.contaboserver.net` is linked to Contabo, but ensure no unauthorized subdomains or misconfigurations.
4. Block Tor Exit Nodes: If this IP is not a legitimate Tor relay, consider blocking Tor exit nodes in your firewall rules.
Recommended Tools: Use `ipdebrief_actions` to generate custom firewall rules for mitigation.
---
*End of Briefing*
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
π’ Ownership & Registration
| Organization | Contabo Inc. |
| ASN | AS40021 |
| Network Name | CONTA-48 |
| CIDR Block | 144.126.128.0/19 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
π DNS Intelligence
| PTR | vmi3150148.contaboserver.net |
| Forward Confirmed | Yes β FCrDNS verified |
| Forward Hostnames | vmi3150148.contaboserver.net |
π DNS Hygiene
| Hygiene Score | 60% (Good) |
| SPF | 0/2 domains |
| DMARC | 1/2 domains |
| FCrDNS | Verified |
| DNSSEC | Valid |
| CAA | Not configured |
| Domains Checked | 2 domains |
βοΈ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Tier 3 β Basic operator with some routing infrastructure |
π Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | β |
| 443 | https | tcp | β |
| 22 | ssh | tcp | |
| 8080 | http-alt | tcp | β |
| Closed Ports | 25, 3389, 8443 (4 open / 7 scanned) | ||
| Server | nginx/1.24.0 (Ubuntu) |
| HTTP Title | β |
| SSH Version | SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.16 |
π TLS Certificate
| SANs | cto.maifrino.com |
| Valid From | 2026-05-05T21:49:40+00:00 |
| Valid Until | 2026-08-03T21:49:39+00:00 |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_256_GCM_SHA384 |
| Signature Algorithm | sha384ECDSA |
| Validity Period | 89 days |
| Serial Number | 05C75A6AB55CD691800F624569E43DD8B64D |
| Thumbprint | FC2E18A8AFC07E7D001B38A4B55F35C55B3D9407 |
π― Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 29% | 2 | 4 |
| routing | 27% | 2 | 3 |
| services | 30% | 2 | 3 |
| ownership | 35% | 3 | 8 |
| reputation | 25% | 1 | 3 |
| geolocation | 30% | 2 | 3 |
| Overall | 29% | 12 | 24 |
| Data Coherence | Mostly Consistent (80%) β 1 contradiction(s) |
| Attribution | Moderate (55%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
π Observation Timeline π Live
| First Seen | 2026-05-28 16:32:07 UTC |
| Last Seen | 2026-06-29 05:35:34 UTC |
| Profile Built | 2026-06-29 05:38:13 UTC |
| Data Freshness | Live |
| Signal Types | 31 |
| Total Observations | 59 |
Full dossier details are available via our API.