144.91.124.59📋 Copy

# IP Intelligence Briefing: 144.91.124.59/32

## Executive Summary

IP address 144.91.124.59 is a German-based cloud compute endpoint hosted on Contabo infrastructure. The IP presents a Moderate Risk profile (score: 40) with no active threat indicators. The endpoint is classified as "Firewalled / No Services" and shows historical stability without persistent malicious behavior.

## Ownership and Infrastructure

• Organization: Johannes Selg (CONTABO)
• ASN: 51167
• CIDR Block: 144.91.96.0/19
• Infrastructure Type: CloudCompute (Contabo)
• Geolocation: Germany (DE), Munich region
• DNS PTR: vmi1486562.contaboserver.net

## Risk Assessment

• Risk Score: 40/100 (Moderate Risk)
• Abuse Confidence: No active indicators
• Blacklist Status: 2 lists flagged out of 8 total (23% listing rate)
• Threat Classification: Not identified as Tor exit, known attacker, or spam source
• Stability: Not persistently malicious (0 threat observation days)

## Network Behavior

• Open Ports: None detected
• Service Status: Firewalled / No Services
• DNS Resolution: Forward-confirmed (1 PTR record)
• Email Reputation: No SPF/DMARC records detected on associated domain
• Route Stability: 0 route changes in 30-day window; stability flagged as false

## Neighborhood Analysis (144.91.124.0/24)

• Subnet Abuse Density: 0
• Total Siblings: 2
• Active Siblings: 1
• Threat Siblings: 0
• Neighbor Risk Profile: 144.91.124.133 (Risk Score: 30)

## Historical Observations

• Total Records: 18 observations
• Recent Classification: Clean (as of July 30, 2026)
• Threat Persistence: None detected
• Geolocation Validation: ICMP blocked; geolocation plausible but unvalidated

## Related Entities

• DNS Associations: vmi1486562.contaboserver.net (multiple entries)
• Network Association: CONTABO
• Transit Path: Comcast networks observed

## Recommended Security Actions

Based on the moderate risk profile (40), the following firewall rules are recommended:

iptables:

```

iptables -A INPUT -s 144.91.124.59 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 144.91.124.59 drop

```

Cloudflare WAF:

```json

{

"description": "Block 144.91.124.59 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 144.91.124.59"

}

}

```

AWS WAF:

```json

{

"Addresses": ["144.91.124.59/32"],

"Description": "IPDebrief risk 40"

}

```

## Analysis Notes

This IP represents a typical cloud hosting endpoint. The absence of open ports and lack of active threat indicators suggest benign cloud infrastructure usage. The 23% DNSBL listing rate warrants monitoring but does not indicate confirmed malicious activity. The Contabo provider classification indicates shared cloud infrastructure; correlation with 144.91.124.133 (neighbor risk score: 30) suggests moderate-risk neighborhood characteristics.

Threat Level: MODERATE — Consider blocking based on operational requirements; no immediate threat indicators detected.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.