185.192.96.243📋 Copy

INTELLIGENCE BRIEFING: IP 185.192.96.243/32

CLASSIFICATION: LOW RISK INFRASTRUCTURE HOSTING

SUBJECT: IP Address 185.192.96.243

REPORT DATE: 2026-06-27

INTELLIGENCE SOURCE: IPDebrief Threat Intelligence Platform

---

EXECUTIVE SUMMARY

IP 185.192.96.243 is a Contabo cloud hosting infrastructure address located in Germany (ASN 51167). The address demonstrates a low-risk profile (Risk Score: 25) with no active threat indicators. The IP serves as a web hosting server with standard HTTP/HTTPS services and SSH access. No malicious activity or known attacker patterns were observed during analysis.

---

INFRASTRUCTURE PROFILE

Ownership & Provider:

• ASN: 51167 (Contabo GmbH)
• Organization: Johannes Selg
• RIR: RIPE
• Infrastructure Type: Cloud Compute / Hosting
• Registration: Commercial cloud hosting provider

Geolocation:

• Country: Germany (DE)
• Region: VA (Dulles)
• Geolocation Confidence: Plausible but consensus false
• Accuracy Radius: 400km

Network Classification:

• Provider: Contabo
• Cloud Infrastructure: Yes
• CDN/VPN/Proxy: No
• Mobile/Residential: No

---

NETWORK SERVICES

Open Ports:

• Port 80/TCP: HTTP
• Port 443/TCP: HTTPS
• Port 22/TCP: SSH (OpenSSH_9.2p1 Debian)

DNS Resolution:

• PTR Record: vmi2980251.contaboserver.net
• Hosted Domain: contaboserver.net
• Forward Resolution: Confirmed (1 hostname)

TLS/SSL:

• Certificate Issuer: CN=TRAEFIK DEFAULT CERT
• Certificate Subject: CN=TRAEFIK DEFAULT CERT
• Self-Signed: No

---

THREAT INDICATORS

Risk Assessment:

• Overall Risk Score: 25 (Low Risk)
• Reputation: Low Risk
• Abuse Confidence Score: Not applicable
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No

Blacklist Status:

• DNSBL Listed: 1 out of 8 total lists
• Blacklist Count: 0
• No active threat feeds matched

Campaign Correlation:

• Likelihood: None
• CERT Matches: 0
• Correlated IPs: 0

---

OBSERVATION HISTORY

Signal Activity:

• Total Observations: 27
• Threat Persistence Days: 0
• Is Persistently Malicious: No

Recent Signals:

• 2026-06-27: DNS signals observed (contaboserver.net, traefik.default domains)
• 2026-06-25: Geolocation validation attempted (ICMP blocked - unable to validate)
• Risk signals: Minimal observed

Temporal Analysis:

• Ownership Changes: 0
• Threat Observation Count: 1
• No persistent malicious behavior detected

---

RELATIONSHIP ANALYSIS

Connected Entities:

• DNS Associations: vmi2980251.contaboserver.net (multiple records)
• Network Associations: TT-202200809
• Relationship Count: 66 total entities

Subnet Analysis (185.192.96.0/24):

• Abuse Density: 1 (Low)
• Classification: Mostly Clean
• Total Siblings: 1
• Threat Siblings: 1
• Active Siblings: 1

---

CONTROL PLANE DATA

BGP Information:

• Origin ASN: 51167
• BGP Prefix: 185.192.96.0/23
• Route Stability: Not stable
• Route Changes (30d): 0

DNS Security:

• DNSSEC Valid: Yes
• CAA Records: No
• RPKI State: Not evaluated

Operator Score: 0.2609 (Basic)

---

RECOMMENDED ACTIONS

Firewall Rules:

• No blocking recommended (low risk profile)
• Standard monitoring recommended for SSH and web services
• No aggressive filtering advised

Security Recommendations:

• Monitor for any changes in service patterns
• Standard logging for HTTP/HTTPS traffic
• SSH access should be restricted if not required

---

INTELLIGENCE ASSESSMENT

IP 185.192.96.243 represents normal cloud hosting infrastructure with no evidence of malicious activity. The address is part of Contabo's commercial hosting network and exhibits standard web server behavior. No immediate threat mitigation actions are required. Routine monitoring is recommended to detect any behavioral changes.

THREAT LEVEL: LOW

ACTION REQUIRED: MONITOR

CONFIDENCE: HIGH

---

*Report generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.