213.136.89.197📋 Copy

# IP Intelligence Briefing: 213.136.89.197

## Executive Summary

The IP address 213.136.89.197 is classified as Moderate Risk (Score: 40) and operates as a cloud infrastructure endpoint hosted on Contabo. The IP shows minimal malicious activity but is associated with a virtual machine instance on a cloud hosting provider network.

## Infrastructure Profile

• Provider: Contabo (ASN 51167)
• Organization: Johannes Selg
• Geolocation: Germany (DE), Grand Est region, Lauterbourg
• Infrastructure Type: CloudCompute
• Network Role: Cloud hosting provider environment

## Technical Details

• Hostname: vmi3096088.contaboserver.net
• DNS Resolution: Forward confirmed with single PTR record
• Service Status: No open ports detected; HTTP 2.0 with 404 response
• DNS Security: No SPF or DMARC records configured on associated domain
• DNSBL Presence: Listed on 2 of 8 total blacklist entries
• Route Stability: Not route stable; BGP prefix 213.136.88.0/23

## Threat Assessment

The IP demonstrates low threat persistence with only one threat observation recorded. No active campaigns, known attacker signatures, or Tor exit node activity detected. The "Basic" operator score (0.2609) indicates limited routing intelligence available for this endpoint.

## Historical Observation

• Total Observations: 22 signals recorded
• Recent Activity: Cloud infrastructure classification confirmed in June 2026
• Reputation Trend: Consistent classification as cloud hosting infrastructure with stable provider association

## Neighborhood Analysis

• Subnet: 213.136.89.0/24
• Abuse Density: Low (0)
• Neighbor Risk Distribution: No high-risk neighbors detected
• Classification: Mostly clean subnet with minimal inherited risk (Score: 2)

## SOC Recommendations

1. Monitoring: Implement passive traffic monitoring for this IP; no immediate blocking required

2. Allow Rules: If legitimate traffic is observed, permit with rate limiting due to cloud hosting nature

3. Threat Hunting: Monitor for abuse patterns from this Contabo infrastructure; check for correlated activity with related VMI hostnames

4. Block Decision: No block recommendation at this time; risk score (40) falls below typical threshold for proactive blocking

5. Alerting: Configure alerts for port scans or unusual outbound connections from this IP

## Actionable Intelligence

This IP represents standard cloud infrastructure usage with moderate risk scoring primarily due to blacklist presence and lack of DNS security records. The endpoint shows no indicators of active exploitation or malicious campaigns. Continued monitoring recommended without immediate remediation actions.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.