185.2.101.118📋 Copy

# INTELLIGENCE BRIEFING: 185.2.101.118/32

## EXECUTIVE SUMMARY

IP 185.2.101.118 is a low-risk web server hosted on Contabo cloud infrastructure in Germany. Current risk assessment scores 25 (Low Risk) with no active threat indicators. The IP demonstrates standard hosting behavior with no evidence of malicious activity or association with known attack campaigns.

## PROFILE SUMMARY

Classification: Cloud Compute Web Server

Provider: Contabo (ASN: 51167)

Organization: Johannes Selg

Geolocation: Lauterbourg, Grand Est, Germany (DE)

Risk Score: 25 (Low)

Reputation: Low Risk

Network Infrastructure

• Infrastructure Type: Cloud Compute (Hosted)
• CIDR Block: 185.2.100.0/22
• DNS Classification: contaboserver.net (VMI: vmi3246496)
• Network Role: Web Server

Open Ports & Services

SSH Banner indicates OpenSSH 9.2p1 Debian-2+deb12u10. TLS certificate and HTTP title data unavailable.

## THREAT INDICATORS

Current Threat Status: CLEAN

Threat Indicators: None detected

Blacklist Status: Listed on 1 of 8 DNSBLs

Known Campaigns: None associated

Is Tor Exit: No

Is Known Attacker: No

Is Spam Source: No

Control Plane Analysis

• Operator Score: 0.2609 (Basic)
• DNSBL Listings: 1/8 lists
• Route Stability: Unstable
• BGP Prefix: 185.2.100.0/22
• RPKI State: Not verified

## NEIGHBORHOOD ANALYSIS

Subnet: 185.2.101.0/24

Abuse Density: 0.6667 (Mixed)

Total Siblings: 3

Threat Siblings: 2

Neighboring IPs:

All neighbors show consistent risk profiles with no high-risk indicators. Subnet classification: mostly_clean.

## OBSERVATION HISTORY

Total Observations: 25 signals

Observation Period: Recent (2026-06-17)

Recent Signal Activity:

• DNS resolution confirmed to vmi3379782.contaboserver.net (95% confidence)
• Port scanning activity detected (80, 443, 22, and others)
• TLS/HTTP service scanning (connection failures observed)
• Operator scoring signals (Basic classification, 3/8 signals)
• Full profile scoring (6/6 dimensions covered, 25.9% confidence)

No persistent malicious behavior detected. Threat persistence: 0 days.

## RELATIONSHIP GRAPH

Total Relationships: 47

Primary Associations:

• DNS Associations: vmi3246496.contaboserver.net (multiple records)
• Network Association: CONTABO
• Infrastructure: Shared hosting environment

No organization-level or certificate-based relationships detected. Campaign correlation: None.

## RECOMMENDED ACTIONS

Security Recommendations: None required

Firewall Rules: Not recommended for blocking

Risk Level: Acceptable for monitoring

Analysis: The IP demonstrates standard web hosting behavior with no malicious indicators. The single DNSBL listing requires investigation but does not constitute active threat. Standard logging and monitoring recommended; no blocking or rate-limiting actions advised based on current risk profile.

## ASSESSMENT

IP 185.2.101.118 represents normal cloud hosting infrastructure with no evidence of malicious activity. The Contabo hosting environment shows consistent low-risk behavior across the /24 subnet. No immediate security actions required. Continue standard monitoring practices.

---

*Intelligence generated from IPDebrief threat analysis platform. Data accuracy depends on signal availability and freshness.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.