173.249.35.243📋 Copy

## Intelligence Briefing: 173.249.35.243/32

Classification: Moderate Risk | Date: 2026-08-06 | Status: Active

Executive Summary

IP 173.249.35.243 is a Contabo residential hosting endpoint located in Germany with a moderate risk profile (Score: 50). The address shows no active threat indicators and no evidence of malicious activity. The IP is currently firewalled with no accessible services, presenting minimal immediate threat to network operations.

Ownership and Network Classification

The IP is registered under CONTABO (AS51167), a known hosting provider. Geolocation data indicates placement in the Berlin timezone region with coordinates 51.17°N, 10.45°E.

DNS and Service Analysis

• PTR Hostname: vmi3066229.contaboserver.net
• Forward Resolution: Forward confirmed (1 hostname)
• Domain: contaboserver.net
• Open Ports: None detected
• TLS Certificate: None
• HTTP Service: None
• Service Purpose: Firewalled / No Services

The endpoint is effectively passive with no open services or reverse DNS entries beyond the VM hostname.

Threat Indicators

No threat feeds, reputation sources, or blacklist matches were detected. The IP is not classified as a known attacker or spam source.

Neighborhood Analysis (173.249.35.0/24)

The /24 subnet shows minimal activity with only one neighboring IP (173.249.35.161) and no evidence of coordinated malicious activity.

Relationship Graph

The IP exhibits the following relationships:

• DNS Associations: vmi3066229.contaboserver.net (repeated in relationship records)
• Network Associations: CONTABO (repeated)

All relationships point to the same hostname and network, indicating a single endpoint with no additional correlated infrastructure.

Observation History

Sixteen observations were recorded between 2026-08-06T08:04:59 and 2026-08-06T08:09:21 UTC. Key signals include:

• Geolocation: Consistent DE classification with 0.52 confidence (multi-signal inference)
• Network Performance: Average RTT 114.4ms, min 111ms, max 119ms
• Geo Validation: Plausible (401.9km distance from origin)
• Operator Score: 0.2609 (Basic classification)

No ownership changes, threat persistence, or malicious observations were detected during the monitoring window.

Control Plane and Routing

The control plane shows stable routing with no recent changes. DNSSEC is valid, though the IP appears on 2 of 8 DNSBL lists (exact lists not detailed in summary).

Recommended Actions

Current Risk Level: LOW-MODERATE

SOC Analyst Guidance:

1. Traffic Policy: Standard allow policies appropriate for Contabo residential hosting. No immediate blocking required.

2. Monitoring: Continue passive observation. No active threats detected.

3. Exception Handling: If outbound connections to this IP are observed from internal systems, review for data exfiltration patterns.

4. Threat Intelligence: No campaign correlations or related threat indicators.

Conclusion

IP 173.249.35.243 presents a moderate risk profile primarily due to its hosting provider classification. No active threats, malicious indicators, or abuse patterns were detected. The IP is currently passive (firewalled) with no accessible services. Standard defensive policies with ongoing monitoring are appropriate. No immediate action required.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.