213.199.41.196📋 Copy

# INTELLIGENCE BRIEFING: 213.199.41.196/32

## EXECUTIVE SUMMARY

IP address 213.199.41.196 is a Contabo cloud computing VPS located in Germany with a moderate risk profile (risk score: 50). No active services detected; the IP is firewalled with no open ports. Recommended action: Block at perimeter and application layers pending correlation with additional threat signals.

---

## PROFILE DETAILS

---

## THREAT INDICATORS

• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Blacklist Count: 0
• DNSBL Listed: 2 of 8 total lists
• Threat Feeds: None identified
• Campaign Affiliation: None detected

---

## NETWORK OBSERVATIONS

• Open Ports: None detected
• TLS Certificate: None
• HTTP Service: None
• PTR Hostname: vmi2889171.contaboserver.net
• Forward Resolution: Confirmed
• Email Authentication: SPF/DMARC not configured

---

## NEIGHBORHOOD ANALYSIS (213.199.41.0/24)

• Abuse Density: 0
• Threat Siblings: 0
• High-Risk Neighbors: 0
• Medium-Risk Neighbors: 0
• Low-Risk Neighbors: 0

---

## TEMPORAL ANALYSIS

• Observations: 15 recorded
• Ownership Changes: 0
• Threat Persistence: 0 days
• Is Persistently Malicious: No
• Recent Activity: Consistent geolocation and ownership data from 2026-08-06

---

## RELATIONSHIP MAPPING

• DNS Associations: vmi2889171.contaboserver.net (multiple records)
• Network Association: TT-20240306
• Correlated IPs: 0

---

## RECOMMENDED ACTIONS

Firewall Rules

iptables:

```bash

iptables -A INPUT -s 213.199.41.196 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 213.199.41.196 drop

```

nginx:

```nginx

deny 213.199.41.196;

```

pfSense:

```

213.199.41.196/32

```

Cloudflare WAF:

```json

{"description":"Block 213.199.41.196 — IPDebrief risk score 50","action":"block","filter":{"expression":"ip.src eq 213.199.41.196"}}

```

AWS WAF:

```json

{"Addresses":["213.199.41.196/32"],"Description":"IPDebrief risk 50"}

```

---

## INTELLIGENCE ASSESSMENT

This IP represents a Contabo virtual machine with moderate risk scoring. The absence of open ports and services suggests the instance is either dormant, under construction, or aggressively firewalled. The 2/8 DNSBL listings indicate potential reputation issues, though no specific blacklist sources are identified. The low abuse density in the /24 subnet suggests isolated activity rather than coordinated abuse. Correlate with additional threat signals before implementing blocking rules.

Classification: Moderate Risk - Cloud Hosting Infrastructure

Recommended Action: Block with correlation required

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.