161.97.184.113📋 Copy

# IP Intelligence Briefing: 161.97.184.113/32

## Executive Summary

IP address 161.97.184.113 presents a Moderate Risk profile (Risk Score: 40) associated with CONTABO hosting infrastructure in Germany. The IP operates as a web server (Apache/2.4.37 on Rocky Linux) with no active threat indicators but exhibits DNSBL listings on 2 of 8 threat feeds. Recommended mitigation is blocking at the perimeter firewall.

---

## Technical Profile

Network & Ownership

• ASN: 51167 (CONTABO)
• Organization: Johannes Selg
• CIDR Block: 161.97.184.0/22
• RIR: ARIN

Geolocation

• Country: Germany (DE)
• Coordinates: 51.17, 10.45 (Europe/Berlin timezone)
• Geo Validation: Plausible (RtT: 110-120ms average)

Services & Ports

DNS Analysis

• PTR Hostname: vmi2531376.contaboserver.net
• Forward Resolution: vmi2531376.contaboserver.net (forward confirmed)
• TLS Certificate: Self-signed (E=root@issabel.local, CN=issabel.local, OU=PBX, O=Issabel)
• Security Posture: SPF and DMARC not configured

---

## Threat Assessment

Risk Indicators

• Risk Score: 40/100 (Moderate)
• DNSBL Listings: 2 of 8 threat feeds
• Abuse Confidence Score: Not assigned
• Known Campaigns: None detected
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

Control Plane Status

• Route Stability: Flagged as unstable
• RPKI State: Not validated
• DNSSEC: Valid

---

## Historical Observations

Total signals collected: 22 observations

Most recent activity (2026-08-06):

• Geolocation consistent with Germany (401.9km from probe location)
• HTTP/HTTPS services responding normally (200 status code)
• Server fingerprint: Apache/2.4.37, PHP/7.4.33
• No persistent malicious activity detected
• Threat observation count: 1 (transient)

---

## Network Neighborhood Analysis

Subnet: 161.97.184.113/24

• Abuse Density: 0.5 (moderate)
• Classification: mostly_clean
• Total Siblings: 2 active siblings
• Threat Siblings: 1
• Neighbor Risk Distribution: 1 low, 0 medium, 0 high

Notable Neighbor:

• 161.97.184.127: Risk Score 0, Authority Score 60 (clean profile)

---

## Relationships

• Network Association: CONTABO
• DNS Associations: vmi2531376.contaboserver.net (multiple entries)
• Total Relationships: 8 identified

---

## Recommended Security Actions

Firewall Rules (Recommended)

Mitigation Notes

• DNSBL presence indicates prior reputation issues
• Self-signed TLS certificate suggests limited security hygiene
• Route instability may indicate hosting provider issues
• No active attack indicators; block recommendation is precautionary

---

Classification: Moderate Risk — Monitor or Block Based on Policy

Last Updated: 2026-08-06

Data Sources: IPDebrief Intelligence Platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.