195.26.250.147📋 Copy

INTELLIGENCE BRIEFING: 195.26.250.147/32

Classification: MODERATE RISK — Cloud Hosting Infrastructure

---

EXECUTIVE SUMMARY

IP address 195.26.250.147 is a Contabo cloud hosting instance (AS206509) with a risk score of 50. The IP operates as a web server with standard HTTP/HTTPS services and SSH access. Geolocation data shows significant validation issues. The IP has been observed on threat feeds with high severity ratings and displays inconsistent network behavior patterns.

---

NETWORK OWNERSHIP & INFRASTRUCTURE

• ASN: 40021 / AS206509 (kcom group limited)
• Organization: Contabo
• CIDR Block: 195.26.248.0/21
• Infrastructure Type: Cloud Computing
• Network Role: Web Server / Cloud Hosting
• Registration Authority: RIPE
• Abuse Contact: Available via RDAP

Geolocation Discrepancy: Reported location indicates Germany (51.17°N, 10.45°E), but RTT measurements (40ms) contradict the claimed distance of 7,115.6km from probe origin (minimum possible RTT for that distance is 142.3ms). Geovalidation flag set to false with 5 probe attempts.

---

DNS & IDENTIFICATION

• PTR Hostname: vmi2748067.contaboserver.net
• Reverse DNS: Confirmed (forward confirmed: true)
• Hosted Domain: contaboserver.net
• Email Authentication: No SPF or DMARC records configured
• TLS Certificate: Self-signed certificate (CN=localhost)
• Web Server: nginx/1.24.0 (Ubuntu)

---

OPEN SERVICES

---

THREAT INTELLIGENCE

Risk Profile: Moderate Risk (Score: 50)

Threat Indicators:

• Blacklist Count: 0 (profile level)
• DNSBL Listings: 2 of 8 total lists
• Maximum Severity Listed: High
• Is Tor Exit: No
• Is Known Attacker: No
• Is Spam Source: No

Historical Signals (24 observations):

• Recent high-severity threat feed listings (August 5, 2026)
• Connection failures observed on HTTPS
• Geographic signals inconsistent with declared location
• No persistent malicious activity detected
• Threat observation count: 0 (not persistently malicious)

Relationships: 18 relationship entries identified, primarily DNS associations to vmi2748067.contaboserver.net and network associations to TT-20240430.

---

SUBNET ANALYSIS

Neighborhood: 195.26.250.0/24

• Abuse Density: 0 (classified as clean)
• Total Siblings: 1
• Active Siblings: 1
• Threat Siblings: 0
• Inherited Risk: 0

---

RECOMMENDED ACTIONS

Security Recommendations: Block this IP based on risk score and threat feed listings.

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 195.26.250.147 -j DROP

# nftables

nft add rule inet filter input ip saddr 195.26.250.147 drop

# Nginx

deny 195.26.250.147;

# pfSense

195.26.250.147/32

# Cloudflare WAF

Block 195.26.250.147 — IPDebrief risk score 50

# AWS WAF

Addresses: ["195.26.250.147/32"]

Description: IPDebrief risk 50

```

---

ANALYST NOTES

This IP belongs to a cloud hosting environment (Contabo) and should be evaluated based on contextual threat indicators rather than alone. The high-severity threat feed listings and DNSBL presence warrant blocking, though the moderate overall risk score (50) and clean subnet neighborhood suggest this may represent a compromised instance rather than a persistent threat actor. The geolocation inconsistency is notable and may indicate spoofed location data or multi-hop traffic patterns.

Last Updated: August 2026

Data Sources: IPDebrief Intelligence Platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.