167.86.102.199📋 Copy

# IP Intelligence Briefing: 167.86.102.199/32

Classification: Moderate Risk

Date: 2026-08-06

## Executive Summary

IP address 167.86.102.199 is a Contabo cloud server located in Lauterbourg, France (Grand Est). The system presents a moderate risk profile (risk score: 50) and is associated with a Let's Encrypt certificate for the domain "claude.netlol.uk". The IP is listed on 2 of 8 DNSBL feeds and exhibits route instability in its control plane.

## Technical Profile

## Network Services

The following services are running:

• Port 22/TCP: SSH (OpenSSH 9.6p1 Ubuntu)
• Port 80/TCP: HTTP
• Port 443/TCP: HTTPS (TLS 1.3, Cipher: TLS_AES_256_GCM_SHA384)

TLS certificate issued by Let's Encrypt for subject "CN=claude.netlol.uk".

## Threat Indicators

• Abuse Confidence: Not assigned
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• DNSBL Listings: 2 of 8 lists
• Threat Persistence: 0 days observed
• Campaign Correlation: None identified

## Neighborhood Analysis

Subnet 167.86.102.0/24 analysis:

• Abuse Density: 0.3333 (low-to-moderate)
• Classification: Mostly Clean
• Active Siblings: 2 (167.86.102.57, 167.86.102.174)
• Threat Siblings: 1
• Risk Distribution: 2 low-risk, 0 medium/high-risk

## Historical Signals

16 total observations recorded. Recent activity shows:

• Stable TLS configuration with TLS 1.3
• Consistent geolocation measurements (avg RTT: 113.6ms)
• Single threat observation with no persistent malicious behavior
• No ownership changes detected

## Recommended Actions

Based on risk score of 50, the following firewall rules are recommended:

```bash

# iptables

iptables -A INPUT -s 167.86.102.199 -j DROP

# nftables

nft add rule inet filter input ip saddr 167.86.102.199 drop

# Cloudflare WAF

# Block 167.86.102.199 — IPDebrief risk score 50

# AWS WAF

# Address: 167.86.102.199/32

```

## Intelligence Notes

The IP resolves to a VMI (Virtual Machine Instance) on Contabo's infrastructure. DNS relationships consistently point to "vmi3414936.contaboserver.net". The combination of moderate risk score, DNSBL presence, and route instability warrants monitoring. The IP does not appear to be part of an active campaign or coordinated attack infrastructure.

---

*Report generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.