IPDEBRIEF THREAT INTELLIGENCE BRIEFING
Subject: 169.58.76.65/32
Date: Current
Classification: Moderate Risk
---
EXECUTIVE SUMMARY
IP 169.58.76.65 operates as a Contabo cloud compute infrastructure asset within Germany, presenting moderate risk indicators. The IP demonstrates active threat listings across multiple blacklist feeds with maximum severity rated high, though no persistent malicious behavior has been confirmed.
---
INFRASTRUCTURE PROFILE
| Attribute | Value |
|---|---|
| Risk Score | 50 (Moderate Risk) |
| ASN | 51167 |
| Organization | Johannes Selg / TT-20260630 |
| Provider | Contabo (CloudCompute) |
| Geolocation | Germany (DE) |
| CIDR Block | 169.58.0.0/17 |
| DNS Resolution | vmi3466168.contaboserver.net |
| Network Role | Firewalled / No Services |
---
THREAT INDICATORS
- Blacklist Presence: Listed on 2 of 8 threat feeds (dnsblListedCount: 2)
- Threat Severity: Maximum severity classified as high
- Campaign Association: No confirmed campaign correlations
- Malicious Classification: Not flagged as known attacker, spam source, or Tor exit node
Observation History: 20 signal observations tracked. Recent activity (2026-08-13) shows consistent threat listings across multiple sources including AlienVault OTX.
---
SUBNET CONTEXT
/24 Neighborhood (169.58.76.0/24):
- Sibling IP: 169.58.76.7 (Risk Score: 50, Authority Score: 60)
- Abuse Density: 0
- Subnet Classification: Clean
- Total Active Siblings: 2
The broader network classification remains clean, though the target IP shows elevated individual risk metrics.
---
NETWORK BEHAVIOR
- Infrastructure Type: CloudCompute (Contabo hosting)
- Connection Status: No open ports detected
- Services: None active
- Routing Stability: Route changes observed in 30-day period
- Control Plane: RPKI state pending verification
---
RECOMMENDED ACTIONS
Based on risk profile (Score: 50), the following defensive measures are recommended:
| Platform | Recommended Action |
|---|---|
| iptables | `iptables -A INPUT -s 169.58.76.65 -j DROP` |
| nftables | `nft add rule inet filter input ip saddr 169.58.76.65 drop` |
| Nginx | `deny 169.58.76.65;` |
| pfSense | Block 169.58.76.65/32 |
| Cloudflare WAF | Block IP with expression: `ip.src eq 169.58.76.65` |
| AWS WAF | Add IPSet: 169.58.76.65/32 |
---
INTELLIGENCE NOTE
The IP's moderate risk classification combined with active threat listings and high-severity classifications warrants monitoring. While no confirmed malicious activity has been established, the presence in multiple blacklist feeds suggests potential abuse. The Contabo cloud infrastructure classification indicates this is likely a shared hosting environment where multiple tenants operate. Continued observation recommended for emerging threat patterns.
---
END OF BRIEFING
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
๐ข Ownership & Registration
| Organization | Johannes Selg |
| ASN | AS51167 |
| Network Name | TT-20260630 |
| CIDR Block | 169.58.0.0/17 |
| RIR | ARIN |
| Country | DE |
| Abuse Contact | Available via RDAP |
๐ DNS Intelligence
| PTR | vmi3466168.contaboserver.net |
| Forward Confirmed | Yes โ FCrDNS verified |
| Forward Hostnames | vmi3466168.contaboserver.net |
๐ DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Verified |
| DNSSEC | Valid |
| CAA | Not configured |
โ๏ธ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Tier 3 โ Basic operator with some routing infrastructure |
๐ Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | โ |
| HTTP Title | โ |
๐ TLS Certificate
| SANs | None |
| Valid From | โ |
| Valid Until | โ |
๐ฏ Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 35% | 2 | 3 |
| routing | 17% | 1 | 1 |
| services | 24% | 2 | 2 |
| ownership | 35% | 2 | 3 |
| reputation | 17% | 1 | 2 |
| geolocation | 17% | 1 | 1 |
| Overall | 24% | 9 | 12 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (70%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
๐ Observation Timeline ๐ Live
| First Seen | 2026-08-05 18:27:56 UTC |
| Last Seen | 2026-08-13 07:58:37 UTC |
| Profile Built | 2026-08-13 08:12:45 UTC |
| Data Freshness | Live |
| Signal Types | 22 |
| Total Observations | 23 |
Full dossier details are available via our API.