194.5.152.156📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 194.5.152.156/32

Date: 2026-08-06

Classification: MODERATE RISK

Risk Score: 50/100

---

## EXECUTIVE SUMMARY

IP 194.5.152.156 is a Contabo cloud compute infrastructure address located in Lauterbourg, France (Grand Est region). The IP resolves to a virtual machine identifier (vmi2960559.contaboserver.net) and is hosted on Contabo infrastructure (ASN 51167). Current threat indicators show moderate risk with DNS blacklist presence, though no active attack signatures or open services were detected.

---

## INFRASTRUCTURE PROFILE

---

## THREAT INDICATORS

• DNS Blacklist Status: Listed on 2 of 8 DNS blacklists checked
• Abuse Confidence Score: Not assigned
• Known Attack Source: False
• Spam Source: False
• Tor Exit Node: False
• Known Campaigns: None identified
• Open Ports: None detected
• TLS/HTTP Services: None detected

---

## NETWORK RELATIONSHIPS

• DNS Association: vmi2960559.contaboserver.net
• Forward Resolved Hostname: vmi2960559.contaboserver.net
• PTR Record: vmi2960559.contaboserver.net
• Forward Resolution Count: 1
• Email Authentication: SPF not configured, DMARC not configured

---

## SUBNET NEIGHBORHOOD ANALYSIS

Subnet: 194.5.152.0/24

Abuse Density: 0

Classification: Low Risk

Adjacent IP Activity:

• 194.5.152.205: Risk Score 25, Authority Score 60 (Low Risk)

Assessment: The /24 subnet shows minimal abuse activity with only one neighboring IP identified. The target IP's risk profile appears isolated from broader subnet-level malicious activity.

---

## OBSERVATION HISTORY

Total Observations: 13 signals recorded

Recent Activity (2026-08-06):

• DNS blacklist listings detected with high severity (8 total lists, 2 current listings)
• DNSSEC validation confirmed as valid
• ASN registration confirmed (ripencc, allocated 2018-07-23)
• Domain contaboserver.net confirmed with no SPF/DMARC records

Temporal Indicators:

• Ownership changes: 0
• Threat persistence days: 0
• Threat observation count: 0
• Persistently Malicious: False

---

## CONTROL PLANE ANALYSIS

• Route Stability: False
• RPKI State: Not validated
• IRR Consistency: Not validated
• Route Changes (30 days): 0
• DNSSEC Valid: True
• Operator Score: 0

---

## RECOMMENDED ACTIONS

Firewall Blocking: Recommended based on moderate risk profile

iptables:

```

iptables -A INPUT -s 194.5.152.156 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 194.5.152.156 drop

```

nginx:

```

deny 194.5.152.156;

```

AWS WAF:

```json

{

"Addresses": ["194.5.152.156/32"],

"Description": "IPDebrief risk 50"

}

```

Cloudflare WAF:

```json

{

"description": "Block 194.5.152.156 — IPDebrief risk score 50",

"action": "block",

"filter": {"expression": "ip.src eq 194.5.152.156"}

}

```

---

## ANALYST NOTES

1. Infrastructure Provider: Contabo is a legitimate European cloud hosting provider. IPs in this range are typically used for web hosting and cloud services.

2. Blacklist Presence: The two DNS blacklist listings warrant investigation but do not confirm active malicious use. These may result from historical activity or neighbor contamination.

3. Service State: No open ports or active services detected. The IP appears to be in a dormant or firewalled state.

4. Monitoring Recommendation: While current risk is moderate, the blacklist presence suggests ongoing reputation management. Monitor for changes in DNS resolution or service emergence.

5. Contextual Decision: Blocking may be appropriate for strict security postures but should be weighed against Contabo's legitimate cloud hosting operations. Consider allowlisting the broader /24 if the specific IP is causing issues.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.