158.220.111.214📋 Copy

# IP Intelligence Briefing: 158.220.111.214

Classification: LOW RISK

Date: 2026-08-12

Prepared by: IPDebrief Intelligence

---

## EXECUTIVE SUMMARY

IP 158.220.111.214 is a low-risk residential web server hosted on Contabo infrastructure. The IP operates within a /24 subnet with minimal abuse density and shows no active threat indicators. No immediate security action is recommended.

---

## OWNERSHIP & GEOLOCATION

---

## NETWORK CHARACTERISTICS

• Provider: Contabo (IPv4 cloud provider)
• DNS Reverse Resolution: vmi3374424.contaboserver.net
• Open Ports: TCP/80 (HTTP), TCP/443 (HTTPS), TCP/22 (SSH)
• HTTP Server: Caddy
• ISP Type: Hosting/VPS infrastructure

---

## THREAT ASSESSMENT

Current Status: The IP shows no threat indicators. Risk breakdown indicates no malicious activity detected.

---

## OBSERVATION HISTORY

Total Observations: 26 signals

Key Historical Signals:

• Geolocation: Consistently resolved to Germany (DE) with 51.17°N, 10.45°E coordinates
• Operator Score: 0.2609 (Basic classification)
• Infrastructure: Classified as cloud/hosting environment
• DNS Security: DNSSEC valid, CAA records present

Temporal Analysis: No observed threat persistence. IP has maintained stable characteristics throughout observation window.

---

## SUBNET ANALYSIS (158.220.111.0/24)

Neighbor Analysis:

• 158.220.111.161: Risk Score 30, Authority Score 60 (medium risk)
• 158.220.111.203: Risk Score 0, Authority Score 50 (low risk)

---

## RELATIONSHIP GRAPH

DNS Associations: vmi3374424.contaboserver.net (primary hostname)

Network Associations: TT-20230316 (contaboserver.net network)

Certificate Associations: None detected

The IP maintains typical hosting infrastructure relationships with no suspicious external associations.

---

## CONTROL PLANE & ROUTING

• BGP Prefix: 158.220.96.0/20
• Route Stability: Not stable (route changes observed in 30-day window)
• RPKI State: Not validated
• DNSSEC: Valid
• DNSBL Listings: 0/8

---

## RECOMMENDED ACTIONS

Current Risk Score: 0

No immediate firewall or blocking actions recommended.

The IP exhibits standard hosting infrastructure behavior with no threat indicators. Monitor for any changes in risk profile or emergence of threat indicators.

---

## SOC ANALYST NOTES

1. This is a standard Contabo VPS/cloud host with no malicious indicators

2. Subnet 158.220.111.0/24 shows moderate abuse density—monitor sibling IPs

3. No blacklist associations or known campaign involvement

4. SSH port open (standard for VPS hosting)—verify against your organization's policy

5. Consider monitoring for changes in network role or geolocation anomalies

Status: No action required at this time.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.