INTELLIGENCE BRIEFING: 173.249.49.39/32
Classification: LOW RISK / MONITOR
Date: 2026-08-06
Prepared By: IPDebrief Intelligence Unit
---
EXECUTIVE SUMMARY
IP address 173.249.49.39 is associated with Contabo infrastructure in Germany. The IP exhibits low-risk characteristics with a risk score of 25. No active threat indicators, blacklist hits, or malicious campaign associations were detected. The address represents a standard cloud VPS deployment with no open services observed.
---
OWNERSHIP & INFRASTRUCTURE
| Attribute | Value |
|---|---|
| **ASN** | 51167 (Johannes Selg) |
| **Organization** | CONTABO |
| **CIDR Block** | 173.249.32.0/19 |
| **Network Type** | Provider / Hosting |
| **Country** | Germany (DE) |
| **Registration** | ARIN |
The IP is assigned to Johannes Selg's CONTABO network, a legitimate German hosting provider. The address resolves to a virtual machine instance (vmi2459828.contaboserver.net) indicating VPS infrastructure.
---
RISK PROFILE
Overall Risk Score: 25/100 (Low Risk)
| Metric | Value | Assessment |
|---|---|---|
| Reputation | Low Risk | Acceptable |
| Provider Score | 0 | Baseline |
| Authority Score | 0 | Baseline |
| Stability Score | 0 | N/A |
| Abuse Confidence | N/A | Not Flagged |
| Blacklist Count | 0 | Clean |
Threat Indicators: None detected. No Tor exit, known attacker, spam source, or campaign associations identified.
---
NETWORK CHARACTERISTICS
| Characteristic | Status |
|---|---|
| **Open Ports** | None detected |
| **DNS Resolution** | Forward confirmed |
| **PTR Record** | vmi2459828.contaboserver.net |
| **Services** | Firewalled / No services exposed |
| **CDN/Proxy/VPN** | Not identified |
| **AnyCast** | Not enabled |
The IP is actively firewalled with no accessible services, reducing attack surface exposure.
---
OBSERVATION HISTORY
Total Observations: 16 signals recorded
Key Temporal Indicators:
- Ownership Changes: 0 (stable)
- Threat Persistence Days: 0 (no persistent activity)
- Threat Observation Count: 0 (benign)
- Last Activity: 2026-08-06
Geolocation Signals:
- Country: Germany (DE)
- Latitude: 51.17°N
- Longitude: 10.45°E
- Accuracy: 400km radius
- Confidence: 0.52 (multi-signal inference)
Network Performance:
- Average RTT: 107.8ms
- Min RTT: 105ms
- Max RTT: 112ms
- Distance: ~402km from probe location
The IP demonstrates stable characteristics with no degradation in quality or emergence of threat patterns over the observation period.
---
RELATIONSHIP ANALYSIS
Connected Entities: 5 relationships identified
| Relationship Type | Target |
|---|---|
| DNS Association | vmi2459828.contaboserver.net |
| Same Network | CONTABO |
| DNS Association | vmi2459828.contaboserver.net |
| Same Network | CONTABO |
| DNS Association | vmi2459828.contaboserver.net |
No certificate associations or organizational links beyond the hosting provider were discovered. The IP operates in isolation without known peer infrastructure.
---
SUBNET ANALYSIS
Network: 173.249.49.0/24
- Total Neighbor IPs: 0
- Abuse Density: 0%
- High Risk Siblings: 0
- Medium Risk Siblings: 0
- Low Risk Siblings: 0
The /24 subnet shows zero abuse activity, with no threat-adjacent neighbors identified.
---
CONTROL PLANE DATA
| Metric | Value |
|---|---|
| BGP Prefix | 173.249.48.0/23 |
| Origin ASN | 51167 |
| Route Stability | False |
| Route Changes (30d) | 0 |
| DNSSEC | Valid |
| DNSBL Listed | 1 of 8 lists |
| Operator Score | 0.2609 (Basic) |
---
RECOMMENDATIONS
Security Posture: ACCEPTABLE
1. Allow Traffic: No blocking required. The IP exhibits benign characteristics consistent with legitimate hosting infrastructure.
2. Monitoring: No enhanced monitoring required. Maintain standard logging practices.
3. Firewall Rules: No specific deny rules recommended. Standard provider-based filtering applies.
4. Threat Intelligence: No correlation with known campaigns or threat actors.
---
CONCLUSION
IP 173.249.49.39 represents a low-risk Contabo VPS instance with no malicious indicators. The address demonstrates stable network characteristics, clean reputation, and no association with threat infrastructure. No defensive actions beyond standard operational procedures are recommended.
Final Risk Assessment: LOW RISK โ No action required.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
๐ข Ownership & Registration
| Organization | Johannes Selg |
| ASN | AS51167 |
| Network Name | CONTABO |
| CIDR Block | 173.249.32.0/19 |
| RIR | ARIN |
| Country | DE |
| Abuse Contact | Available via RDAP |
๐ DNS Intelligence
| PTR | vmi2459828.contaboserver.net |
| Forward Confirmed | Yes โ FCrDNS verified |
| Forward Hostnames | vmi2459828.contaboserver.net |
๐ DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Verified |
| DNSSEC | Valid |
| CAA | Not configured |
โ๏ธ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Multi-Service Host |
| Network Tier | Tier 3 โ Basic operator with some routing infrastructure |
๐ Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | โ |
| 22 | ssh | tcp | |
| Closed Ports | 25, 443, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | nginx/1.29.4 |
| HTTP Title | โ |
| SSH Version | SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.18 |
๐ TLS Certificate
| SANs | None |
| Valid From | โ |
| Valid Until | โ |
๐ฏ Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 35% | 2 | 3 |
| routing | 17% | 1 | 1 |
| services | 35% | 2 | 3 |
| ownership | 35% | 2 | 3 |
| reputation | 17% | 1 | 2 |
| geolocation | 35% | 2 | 3 |
| Overall | 29% | 10 | 15 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (70%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
๐ Observation Timeline ๐ Live
| First Seen | 2026-08-05 18:27:58 UTC |
| Last Seen | 2026-08-13 07:59:48 UTC |
| Profile Built | 2026-08-13 08:12:45 UTC |
| Data Freshness | Live |
| Signal Types | 21 |
| Total Observations | 21 |
Full dossier details are available via our API.