194.163.172.43📋 Copy

IP Intelligence Briefing: 194.163.172.43

Date: 2026-06-12

---

**1. Core Profile**

• Risk Score: 50 (Moderate Risk)
• Ownership: Owned by Contabo (AS51167), a cloud hosting provider.
• Geolocation:

- Country: Germany (DE)

- City: Lauterbourg (Düsseldorf region)

- Coordinates: 51.17°N, 10.45°E

• Network Role:

- Type: Cloud Compute (Hosting)

- Services: HTTP/HTTPS (port 80/443), Nginx server banner.

- DNS: Resolves to `vmi2692138.contaboserver.net`.

---

**2. Threat & Abuse Indicators**

• Threat Signals: No malicious indicators (no malware, spam, or known attacker associations).
• Abuse Density: Subnet 194.163.172.0/24 has 0% abuse density.
• Neighbors:

- One sibling IP (194.163.172.121) with a 50 risk score (similar to the target).

---

**3. Historical Observations**

• Observation Count: 25 signals over 30 days.
• Consistency:

- Stable geolocation in Düsseldorf (Germany).

- No significant changes in risk scores or threat indicators.

• DNS Stability: Resolves consistently to the same hostname.

---

**4. Relationships & Context**

• Linked Entities:

- Network: Contabo (AS51167).

- DNS: `vmi2692138.contaboserver.net` (hosted domain: `contaboserver.net`).

• Subnet: Part of 194.163.160.0/19 (Contabo’s CIDR block).

---

**5. Actionable Recommendations**

• Firewall Rules (Example):

- iptables: `iptables -A INPUT -s 194.163.172.43 -j DROP`

- Cloudflare WAF: Block IP with rule `{ "action": "block", "expression": "ip.src eq 194.163.172.43" }`.

• Monitoring:

- Track traffic anomalies or deviations from established patterns.

- Monitor linked subnet (194.163.172.0/24) for potential lateral movement.

---

**6. Summary**

The IP 194.163.172.43 is a legitimate cloud server operated by Contabo, hosting a web service with no detected malicious activity. While its risk score is moderate (50), there are no direct threats or abuse indicators. The subnet has low abuse density, and neighboring IPs show similar risk profiles. SOC teams should monitor for unusual traffic patterns but may not require immediate action unless tied to a specific threat context.

Next Steps:

• Validate DNS and server banners for consistency.
• Cross-reference with internal threat feeds for contextual relevance.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.