# 209.50.188.159 — IP Intelligence Summary

209.50.188.159 is an IPv4 address operated by lir-de-3xktechgmbh-1-MNT (AS200373), geolocated to Toronto, Germany. As of October 5, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/209.50.188.159
- Last updated: 2026-10-05

## Ownership

- Organization: lir-de-3xktechgmbh-1-MNT
- Network name: DE-3XKTECHGMBH-20000810
- Allocated block: 209.50.160.0/19
- ASN: AS200373 (https://ipdebrief.com/asn/200373)
- Regional registry: ARIN

## Location

- City: Toronto
- Region: Ontario
- Country: Germany
- Time zone: Europe/Berlin

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Exposed services

- 22/tcp — ssh

## Analyst narrative

\## IP Intelligence Briefing: 209.50.188.159/32

**Classification:** Low Risk / No Action Required

**Report Date:** 2026-07-24

\---

\### Executive Summary

IP address 209.50.188.159 presents a low-risk profile with a risk score of 25. The address is assigned to a German hosting organization (lir-de-3xktechgmbh-1-MNT) with no active threat indicators. No services are currently detected, and the subnet demonstrates clean abuse density metrics.

\---

\### Network Ownership & Registration

\- **ASN:** 200373

\- **Organization:** lir-de-3xktechgmbh-1-MNT

\- **Netname:** DE-3XKTECHGMBH-20000810

\- **CIDR Block:** 209.50.160.0/19

\- **RIR:** ARIN

\- **Abuse Contact:** friedrich.kraeft@3xktech.cloud

\- **Registration Date:** Not available

\---

\### Geographic Profile

\- **Country:** Germany (DE)

\- **Region/State:** Ontario (data inconsistency noted)

\- **City:** Toronto (geolocation mismatch with organizational registry)

\- **Coordinates:** 51.17°N, 10.45°E

\- **Geo Consensus:** True (1 source)

\- **Geo Plausibility:** False

\---

\### Threat Assessment

\- **Risk Score:** 25 (Low Risk)

\- **Provider Score:** 0

\- **Authority Score:** 0

\- **Blacklist Count:** 0

\- **DNSBL Listed:** 1 of 8 total lists

\- **Tor Exit Node:** No

\- **Known Attacker:** No

\- **Spam Source:** No

\---

\### Network Activity & Services

\- **Open Ports:** None detected

\- **Service Classification:** Firewalled / No Services

\- **DNS Resolution:** No forward resolution confirmed

\- **Hosted Domains:** 0

\- **TLS Certificate:** Not detected

\- **HTTP Title:** Not detected

\- **Behavioral:** No honeypot hits, no enumeration strikes recorded

\---

\### Subnet Analysis (209.50.188.0/24)

\- **Abuse Density:** 0 (Clean)

\- **Total Siblings:** 3

\- **Active Siblings:** 0

\- **Threat Siblings:** 0

\- **Subnet Classification:** Clean

\- **Neighbor Risk Distribution:** 2 low risk, 0 medium risk, 0 high risk

\- **Notable Neighbors:**

\- 209.50.188.22: Risk Score 25, Authority Score 50

\- 209.50.188.182: Risk Score 0, Authority Score 50

\---

\### Relationship Graph

\- **Related Entities:** 2 relationships identified

\- **Network Associations:** DE-3XKTECHGMBH-20000810 (same network)

\- **Associated Hostnames:** None

\- **Associated Organizations:** lir-de-3xktechgmbh-1-MNT

\- **Certificates:** None

\---

\### Observation History (15 Signals)

Recent observations (2026-07-24) indicate stable network characteristics:

\- Ownership registration confirmed with lir-de-3xktechgmbh-1-MNT

\- No threat persistence days recorded

\- Not classified as persistently malicious

\- Signal confidence ranged from 0.30 to 0.95

\---

\### Control Plane & Routing

\- **BGP Prefix:** 209.50.188.0/24

\- **Route Stability:** False

\- **Route Changes (30d):** 0

\- **RPKI State:** Not available

\- **IRR Consistency:** Not available

\- **DNSSEC Valid:** True

\---

\### Recommended Actions

No specific firewall rules or security actions are recommended at this time. The IP presents low-risk characteristics with no active threat indicators. Continue standard monitoring practices.

\---

\### Intelligence Notes

1. **Geo Discrepancy:** Organizational registry indicates German entity (DE), but geolocation data points to Toronto, Ontario. Investigate further if geo-accuracy is critical to your use case.

2. **Service Inactivity:** No open ports or services detected. IP may be firewalled or used for passive purposes.

3. **Subnet Health:** The /24 subnet demonstrates clean abuse density with no threat siblings.

4. **Limited Relationships:** Minimal relationship graph suggests limited infrastructure interconnectivity.

\---

*Report generated from IPDebrief intelligence platform data. Monitor for changes in risk profile or service activation.*

## Nearby addresses

- 209.50.188.22 (https://ipdebrief.com/209.50.188.22)
- 209.50.188.182 (https://ipdebrief.com/209.50.188.182)

---

Source: IPDebrief, "209.50.188.159 IP intelligence", https://ipdebrief.com/209.50.188.159, updated 2026-10-05. Assessments are probabilistic.