195.26.244.42📋 Copy

# Threat Intelligence Briefing: 195.26.244.42/32

## Executive Summary

IP 195.26.244.42 is a low-risk (score: 25) cloud-hosted infrastructure address operating within Contabo's German network. The IP presents as a standard web server virtual machine with no active threat indicators, though geolocation validation inconsistencies warrant monitoring.

## Ownership & Infrastructure

• Provider: Contabo (cloud hosting)
• ASN: AS40021 (Johannes Selg)
• CIDR Block: 195.26.240.0/21
• Network Name: TT-20240430
• RIR: RIPE
• Infrastructure Type: Cloud Compute / Web Server

## Technical Profile

• DNS: vmi2356336.contaboserver.net (virtual machine identifier, no hosted domains)
• Open Ports: 22 (SSH), 80 (HTTP), 443 (HTTPS)
• TLS Certificate: CN=Easypanel (organizational certificate)
• HTTP/2: Enabled
• Security Headers: None configured (no HSTS, CSP, or referrer policy)

## Geolocation Validation

• Reported Location: Germany (51.17°N, 10.45°E)
• RTT Anomaly: 39ms observed vs 142.3ms minimum possible for 7,115km distance
• Status: GeoPlausible: false (distance/RTT mismatch indicates potential routing anomaly or false geo claim)
• Historical Variations: Claims detected in GB, US, and DE across observation period

## Threat Assessment

• Risk Score: 25 (Low Risk)
• Abuse Confidence: Not elevated
• Blacklist Status: 0 pulsedive listings, 0 DNSBL lists
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

## Neighborhood Analysis

• Subnet: 195.26.244.0/24
• Abuse Density: 0.5 (classified: mostly_clean)
• Sibling IPs: 1 additional IP (195.26.244.64, risk score: 25)
• Threat Siblings: 1

## Security Actions & Recommendations

No automated firewall rules recommended at this risk level. Monitor for:

1. RTT/Geolocation discrepancies - Indicates potential IP spoofing or routing manipulation

2. Port 22 exposure - Standard SSH access; verify if legitimate

3. Historical blacklist activity - 8 listings detected with 1 "high" severity listing in observation history

## Historical Observations

24 total observations recorded. Recent activity (2026-08-05) shows:

• Geolocation validation failures with multiple country claims
• Blacklist listing activity with high-severity classification
• Consistent web server fingerprinting (HTTP/2, status 200)

---

Classification: LOW RISK - Cloud Infrastructure

Action: Monitor geolocation inconsistencies; no immediate blocking required.

Report Generated: Based on IPDebrief intelligence platform data

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.