169.58.129.25
Intelligence Briefing: 169.58.129.25
Analysis identified the target as a cloud compute instance hosted by Contabo (ASN 51167) under the organization Johannes Selg. The system registered a Low Risk reputation score of 25 with no specific threat indicators or known campaign affiliations.
Geolocation data placed the host in Germany, though source consensus was not achieved due to conflicting reports including France. Behavioral logs showed zero active incidents, honeypot hits, or WAF violations, while the threat actor classification remained "Suspicious Host" with low confidence. DNS hygiene was rated Fair due to missing SPF and DMARC records.
The neighborhood assessment flagged one threat sibling within the /24 subnet. Given signal contradictions and low confidence scores, the recommendation was to Monitor.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Johannes Selg |
| ASN | AS51167 |
| Network Name | TT-20260630 |
| CIDR Block | 169.58.128.0/17 |
| RIR | ARIN |
| Country | DE |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | vmi3487916.contaboserver.net |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | vmi3487916.contaboserver.net |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | 0/2 domains |
| DMARC | 0/2 domains |
| FCrDNS | Verified |
| DNSSEC | Valid |
| CAA | Not configured |
| Domains Checked | 2 domains |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Web Server |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
| SSH Version | SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.19 |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_128_GCM_SHA256 |
| Signature Algorithm | sha256RSA |
| Validity Period | 365 days |
| Serial Number | 1401F6F71677EDDB7FE26111D51C581A |
| Thumbprint | 2B3F6C9ABC79580A2A9271EEB9AC5D9D4F15515A |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 22% | 2 | 4 |
| routing | 8% | 1 | 1 |
| services | 22% | 2 | 4 |
| ownership | 20% | 2 | 4 |
| reputation | 18% | 1 | 4 |
| geolocation | 20% | 2 | 4 |
| Overall | 18% | 10 | 21 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Moderate (55%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-08-12 12:20:52 UTC |
| Last Seen | 2026-09-14 13:36:00 UTC |
| Profile Built | 2026-09-14 13:47:44 UTC |
| Data Freshness | Live |
| Signal Types | 24 |
| Total Observations | 40 |
Full dossier details are available via our API.