158.220.126.85📋 Copy

## IP INTELLIGENCE BRIEFING: 158.220.126.85/32

Classification: Cloud Compute Infrastructure (Contabo GmbH)

Risk Assessment: LOW RISK (Score: 25/100)

Report Date: 2026-06-18

Analysis Scope: Full profile, historical signals, relationship graph, and neighborhood analysis

---

EXECUTIVE SUMMARY

IP address 158.220.126.85 operates as a Contabo cloud compute infrastructure instance located in Lauterbourg, Grand Est, DE. The IP maintains a low-risk profile with a reputation score of 25. No active malicious campaigns, known attacker associations, or spam source indicators were detected. The address resolves to a single virtual machine identifier (vmi2939225.contaboserver.net) with SSH service active on port 22.

INFRASTRUCTURE PROFILE

Provider: Contabo GmbH (ASN: 51167)

Infrastructure Type: CloudCompute/Hosting

CIDR Block: 158.220.112.0/20

IP Classification: Single-Service Host

Geolocation Data:

• Primary Location: Lauterbourg, Grand Est, Germany (DE)
• Geographic Consensus: Validated (5 probe sources)
• Distance from claimed coordinates: 401.9 km
• Average RTT: 108.8 ms

NETWORK SERVICES

Open Ports:

• TCP/22 (SSH): Open, banner indicates OpenSSH_9.6p1 Ubuntu-3ubuntu13.16
• No HTTP/HTTPS services detected

DNS Resolution:

• PTR Record: vmi2939225.contaboserver.net
• Forward Resolution: Confirmed
• Hosted Domain Count: 0

THREAT INTELLIGENCE INDICATORS

Current Threat Status: NONE DETECTED

Network Abuse Context:

• Subnet (158.220.126.0/24): Mostly clean classification
• Abuse Density: 0
• Threat Siblings in /24: 1
• Overall Neighborhood Risk: Low

HISTORICAL SIGNAL ANALYSIS

Observation Window: 25 signals across multiple timeframes

Notable Historical Events:

1. 2026-06-18: Proxy/VPN detection with 85% confidence (proxycheck-io source) - flagged as VPN proxy type

2. 2026-06-17: Geographic inconsistencies detected - proxycheck-io reported France location (distance 401.9 km from claimed Germany coordinates)

3. 2026-06-13: Cloud infrastructure confirmed - is_cloud: true, is_hosting: true

Temporal Persistence:

• Ownership Changes: 0
• Threat Observation Count: 1
• Threat Persistence Days: 0
• Persistently Malicious: False

RELATIONSHIP GRAPH

Total Relationships: 44

Key Associations:

• DNS Hostname: vmi2939225.contaboserver.net (multiple associations)
• Network Segment: TT-20230331 (same network references)
• Provider: Contabo GmbH (confirmed via ASN)

SECURITY RECOMMENDATIONS

Risk-Based Action: No immediate blocking recommended due to low-risk classification.

Defensive Considerations:

• Monitor for geographic inconsistency patterns (France vs Germany claims)
• Track proxy/VPN detection signals in historical data
• Standard SSH port traffic from known cloud hosting provider
• No specific firewall rules generated - risk score below action threshold

Monitoring Thresholds:

• Risk Score Action Point: >50
• Threat Indicator Activation: Any campaign correlation
• Blacklist Threshold: 5+ lists

ANALYST NOTES

The IP represents standard cloud hosting infrastructure with no current malicious indicators. Geographic discrepancies and proxy detection signals warrant routine monitoring but do not justify immediate blocking. The IP operates within a clean subnet with minimal abuse density. Recommend standard traffic logging and periodic re-evaluation if threat indicators emerge.

---

*Data Source: IPDebrief Intelligence Platform*

*Classification: Internal Use - SOC Analysis*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.