194.233.86.63📋 Copy

# Intelligence Briefing: IP 194.233.86.63

Classification: LOW RISK

Date: 2026-07-31

Analyst: IPDebrief Intelligence Team

---

## Executive Summary

IP address 194.233.86.63 is a low-risk web server hosted on a Contabo infrastructure in Singapore. The IP carries a risk score of 30/100, is associated with a virtual machine instance (vmi2784751.contaboserver.net), and shows no indicators of active malicious activity. No immediate defensive actions are recommended, though monitoring of open ports and TLS configuration is advised.

---

## Ownership and Infrastructure

• Organization: IRT-CAPL-SG (CONTABO-ASIA-20210409-06)
• ASN: 141995
• CIDR Block: 194.233.84.0/22
• RIR: RIPE
• Network Role: Web Server
• Classification: Infrastructure/Hosting (Not Cloud, CDN, or VPN)

---

## Geolocation

• Country: Singapore (SG)
• Coordinates: 1.35°N, 103.82°E
• Timezone: Asia/Singapore
• GeoValidation: Plausible (minimum RTT: 207.6ms)
• Distance from Probe Origin: 10,379.2 km

---

## DNS and Hostname Resolution

• PTR Record: vmi2784751.contaboserver.net
• Forward Confirmation: Yes
• Hosted Domain: contaboserver.net
• Email Authentication: No SPF or DMARC records configured
• DNSSEC: Valid

---

## Network Services and Exposure

Open Ports:

TLS Configuration:

• Server Banner: nginx
• TLS Protocol: TLS 1.3
• Cipher Suite: TLS_AES_256_GCM_SHA384
• Certificate Issuer: CN=cloudpanel.clp
• Certificate Subject: CN=cloudpanel.clp
• Certificate Status: Self-signed (not validated by CA)

Note: SSH access is publicly exposed, which is a potential attack vector.

---

## Threat Indicators

• Abuse Confidence Score: Not applicable
• Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Threat Feeds: None detected
• Campaign Correlations: None
• DNSBL Listings: 1 of 8 total lists

---

## Neighborhood Analysis (/24 Subnet)

Subnet: 194.233.86.0/24

Abuse Density: 0 (Clean)

Total Siblings: 4

Active Siblings: 1

Threat Siblings: 0

Neighbor Risk Scores:

---

## Historical Observations

Observation Period: 2026-07-31

Total Observations: 20 signals

Temporal Trends:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 0
• Persistently Malicious: No

Recent Signals Include:

• Geographic validation (Singapore)
• SSL/TLS certificate enumeration
• Service banner identification (nginx)
• SSH version fingerprinting
• Connection attempts (some failed)

Trend Assessment: IP shows no escalation in threat activity. Stable ownership with no recent malicious behavior.

---

## Relationships

Primary Association: vmi2784751.contaboserver.net (DNS)

Network Association: CONTABO-ASIA-20210409-06 (Same Network)

Multiple DNS and network relationship links indicate this IP is part of a larger virtualized infrastructure environment. No external organizational or certificate-based relationships detected.

---

## Risk Assessment

Overall Risk: LOW (30/100)

Stability: N/A

Control Plane Risk: Low (Basic operator score: 0.2609)

Key Risk Factors:

1. Open SSH port (22) - potential lateral movement target

2. Self-signed TLS certificate - indicates unverified hosting

3. No SPF/DMARC records - email authentication gaps

4. Single DNSBL listing - potential minor reputation concern

Mitigating Factors:

1. No active threat indicators

2. Clean neighborhood classification

3. No known campaign associations

4. Stable ownership history

---

## Recommendations for SOC Analysts

1. Monitor SSH Access: Track connection attempts to port 22 for brute force activity

2. Certificate Validation: Review self-signed certificate for potential spoofing

3. Email Authentication: Verify if this IP should be blocked from sending email (no SPF/DMARC)

4. Baseline Behavior: Establish normal traffic patterns for this infrastructure

5. Neighborhood Monitoring: Keep awareness of subnet 194.233.86.0/24; one neighbor (194.233.86.245) has elevated risk (50/100)

---

## Conclusion

IP 194.233.86.63 is a standard web hosting endpoint with low risk characteristics. The infrastructure is associated with legitimate Contabo hosting in Singapore. While no immediate threat exists, the exposed SSH service and self-signed certificate warrant standard monitoring. No blocking or restrictive firewall rules are recommended at this time.

Status: Continue Monitoring

Next Review: 30 days or upon threat signal detection

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.