178.18.249.91📋 Copy

# INTELLIGENCE BRIEFING: 178.18.249.91

## Executive Summary

IP 178.18.249.91 is a low-risk cloud compute endpoint operated by CONTABO (AS51167) in the German Grand Est region. Current risk assessment scores 25/100, with no active threat indicators or malicious reputation signals. The endpoint is configured as a firewalled VPS with minimal service exposure.

## Ownership and Infrastructure

• Organization: Johannes Selg (CONTABO)
• ASN: 51167
• CIDR Block: 178.18.248.0/21
• Infrastructure Type: CloudCompute (Contabo)
• Geolocation: DE/Lauterbourg/Grand Est (51.17°N, 10.45°E)
• DNS PTR: vmi2234324.contaboserver.net

## Risk Assessment

## Threat Indicators

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Campaigns: None detected
• Threat Feeds: No matches
• Known Campaigns: Empty

## Network Classification

• Cloud Hosting: Yes
• CDN: No
• VPN/Proxy: No
• Tor Network: No
• Mobile/Residential: No
• Bogon: No
• Anycast: No

## Service Exposure

• Open Ports: None detected
• TLS Certificate: None
• HTTP Banner: None
• Service Purpose: Firewalled / No Services

## Historical Analysis

18 observations recorded with the following key findings:

• Geolocation Variance: Signals show inconsistencies between Germany (52%) and France (70%) classifications, likely due to multi-signal inference methodology
• Recent Listing: One high-severity DNSBL listing observed on 2026-06-20T23:50:36
• Threat Persistence: 0 days (not persistently malicious)
• Ownership Changes: 0 (stable ownership)

## Subnet Neighborhood Analysis

• Subnet: 178.18.249.91/24
• Abuse Density: 0 (no active sibling IPs)
• Classification: Mostly clean
• Inherited Risk: 2
• Active Siblings: 0
• Threat Siblings: 1

## Relationship Graph

31 relationships identified:

• 16 DNS associations to vmi2234324.contaboserver.net
• 15 network associations to CONTABO infrastructure

## Recommended Actions

Current risk score of 25 indicates minimal immediate threat. No specific firewall or blocking rules recommended at this time. Standard monitoring practices apply.

Mitigation Considerations

1. Monitor for DNSBL listing status changes

2. Track geolocation consistency patterns

3. Review any incoming traffic from this IP for anomalies

4. Consider subnet-level analysis for CONTABO infrastructure patterns

---

Classification: Unconfirmed/Low Risk

Last Updated: 2026-06-20

Data Sources: IPDebrief Intelligence Platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.