185.202.223.202📋 Copy

IP Intelligence Briefing: 185.202.223.202

*Generated via IPDebrief Threat Intelligence Platform*

---

**1. Core Profile**

• Risk Score: Moderate (50/100)
• Provider: Contabo (CloudCompute hosting)
• Ownership: Registered to Johannes Selg (ASN 51167, RIPE)
• Geolocation: Lauterbourg, Grand Est, Germany (51.17°N, 10.45°E)
• Network Role: Cloud infrastructure (non-residential, non-TOR)
• Services: Open SSH service (port 22, SSH-2.0-OpenSSH_9.6p1)

---

**2. Threat Indicators**

• Malicious Activity: No active threats, spam, or known attacker associations.
• DNS Associations: Linked to `vmi2968501.contaboserver.net` (no email auth records).
• Subnet Abuse: Subnet `185.202.223.0/24` has 0.5 abuse density (mostly clean).
• Neighbor Risk: One sibling IP (`185.202.223.106`) with low risk (25/100).

---

**3. Temporal Observations**

• Recent Activity:

- DNS and network signals observed in the last 30 days.

- No persistent malicious behavior or campaign correlations.

• Stability: Subnet route stability is low (route changes detected).

---

**4. Actionable Recommendations**

• Firewall Rules:

- Block the IP using:

```bash

iptables -A INPUT -s 185.202.223.202 -j DROP

nft add rule inet filter input ip saddr 185.202.223.202 drop

```

- AWS WAF/Cloudflare WAF rules included in the response.

• Monitoring:

- Verify SSH service for unauthorized access attempts.

- Monitor subnet for unusual traffic patterns due to route instability.

---

**5. Contextual Notes**

• The IP is associated with a legitimate hosting provider (Contabo) and appears to host a single service.
• No malicious campaigns, spam, or Tor exit node activity detected.
• Subnet has minimal abuse risk, but route instability may indicate misconfiguration or network churn.

Next Steps: Validate SSH access logs and monitor for lateral movement or unexpected DNS activity.

---

*Generated by IPDebrief | © 2026 Jason Alberino*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.