213.199.60.255📋 Copy

# IP INTELLIGENCE BRIEFING: 213.199.60.255/32

## Executive Summary

IP 213.199.60.255 is a moderate-risk web server hosted on the Contabo provider infrastructure. The IP demonstrates active threat indicators with DNSBL listings across 2 of 8 monitored blacklists. While the IP resolves to legitimate hostnames (server1.fxtraining-dns.com) with valid TLS certificates, threat feed correlations indicate malicious activity patterns warranting defensive measures.

## Ownership and Infrastructure

• Organization: Johannes Selg (ASN: 51167)
• Network: 213.199.48.0/20 (Netname: TT-20240306)
• Provider: Contabo
• RIR: RIPE
• Geolocation: Germany (DE), 51.17°N, 10.45°E, Europe/Berlin timezone
• Infrastructure Type: Web Server (not cloud, CDN, VPN, or residential)

## Risk Assessment

• Overall Risk Score: 50/100 (Moderate Risk)
• Abuse Confidence: Active threat indicators detected
• DNSBL Status: Listed on 2 of 8 monitored blacklists
• Operator Score: 0.2609 (Basic classification)
• Route Stability: Unstable (route changes detected in 30-day window)

## Technical Profile

Open Services:

Server Fingerprint:

• Web Server: Apache
• Server Banner: Apache
• HTTP Version: 1.1
• TLS Certificate: Let's Encrypt (YR1, O=Let's Encrypt, C=US)
• Certificate Subject: www.fxtraining-dns.com
• SANs: fxtraining-dns.com, mail.fxtraining-dns.com, www.fxtraining-dns.com

DNS Configuration:

• PTR Hostnames: server1.fxtraining-dns.com
• Forward Resolution: Confirmed
• SPF: Present
• DMARC: Present

## Threat Intelligence Indicators

Active Threat Signals:

• Multiple DNSBL listings detected
• Threat feed correlation with alienvault-otx (reputation: 0, has_threats: true)
• Control plane shows route instability and RPKI state concerns
• Network neighborhood classification indicates abuse density of 1 with inherited risk score of 2

Temporal Analysis:

• Observation count: 22 signals
• Threat observation count: 1
• Is persistently malicious: False
• Campaign likelihood: Not detected

Historical Observations (Recent):

• 2026-07-31: Multiple signal types observed including HTTP response (status 200), RTT measurements, and threat feed associations
• Geolocation validation shows inconsistency between claimed and observed coordinates

## Network Relationships

• DNS Associations: server1.fxtraining-dns.com (multiple records)
• Network Associations: TT-20240306
• Same Subnet: 213.199.60.255/24 (neighbor count: 0 per sibling analysis)

## Defensive Recommendations

Based on risk profile and threat indicators, the following actions are recommended:

Immediate Actions:

1. Block traffic at perimeter firewall using provided rules

2. Monitor for lateral movement to related hostnames

3. Verify DNSBL listing causes (legitimate vs. malicious activity)

Recommended Firewall Rules:

• iptables: `iptables -A INPUT -s 213.199.60.255 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 213.199.60.255 drop`
• nginx: `deny 213.199.60.255;`
• Cloudflare WAF: Block rule with expression `ip.src eq 213.199.60.255`
• AWS WAF: Add 213.199.60.255/32 to blocked addresses list

## SOC Analyst Notes

The IP presents a moderate-risk profile with conflicting indicators. While infrastructure appears legitimate (valid certificates, proper DNS configuration, Contabo hosting), the presence on DNSBL lists and threat feed correlations suggest either compromised usage or false positives requiring verification. The route instability and inconsistent geolocation data warrant additional investigation. Recommend correlating with internal logs for any recent connection attempts from this IP to determine if blocking is immediately warranted.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.