167.86.67.211📋 Copy

# IP Intelligence Briefing: 167.86.67.211/32

Date: Current

Status: Moderate Risk (Score: 40/100)

Classification: Cloud Compute Infrastructure

---

## Executive Summary

The IP address 167.86.67.211 is a Contabo cloud computing virtual private server located in Nuremberg, Germany (ASN 51167). The address shows no current active threat indicators but maintains a moderate risk profile due to DNSBL listings on 2 of 8 threat intelligence feeds. No open services or ports were detected during analysis.

---

## Infrastructure Profile

• Organization: Johannes Selg (Contabo GmbH)
• Infrastructure Type: CloudCompute / VPS
• Geolocation: Nuremberg, Germany (51.17°N, 10.45°E)
• Network Block: 167.86.66.0/23
• Reverse DNS: vmi2590711.contaboserver.net
• Forward DNS: vmi3374842.contaboserver.net

---

## Threat Indicators

• Risk Score: 40/100 (Moderate)
• Blacklist Count: 2 of 8 threat feeds
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Scans: None detected
• Threat Persistence: Not observed

---

## Historical Analysis

Analysis of 25 historical observations revealed inconsistent geolocation reporting. One observation flagged proxy/VPN activity with a risk score of 66 from proxycheck-io, reporting France (Paris) as the origin. Current geolocation reports Germany (Nuremberg) with an average RTT of 119ms and 464.5km distance from probe origin. No persistent malicious activity was detected across the observation timeline.

---

## Neighborhood Assessment

The /24 subnet (167.86.67.0/24) demonstrates low abuse density:

• Total Siblings: 256 IPs
• Active Siblings: 1
• Threat Siblings: 2
• Abuse Density: 0 (mostly clean)
• Neighbor Risk Scores: 25 and 0 (both low)

Two neighboring IPs were detected: 167.86.67.121 (Risk: 25) and 167.86.67.147 (Risk: 0).

---

## Related Entities

• Primary Network: CONTABO
• DNS Associations: Multiple contaboserver.net hostnames
• Operator Score: 0.2609 (Basic)
• Route Stability: Not stable
• RPKI State: Not verified

---

## Recommended Actions

• Block: Consider blocking at perimeter firewall if traffic patterns indicate potential abuse
• Monitor: Maintain monitoring due to DNSBL listings
• Investigate: Review traffic logs for outbound connections from this IP
• Context: Treat as legitimate cloud infrastructure unless malicious behavior is observed

---

Conclusion: This IP represents standard Contabo cloud infrastructure with moderate risk due to DNSBL listings. No immediate blocking required unless specific malicious activity is observed in traffic logs.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.