217.77.9.89

{ } JSON 🔧 Full Actions API

🤖 Witness AIThis summary was generated by AI and may contain inaccuracies. Verify critical details independently.

# IP INTELLIGENCE BRIEFING

Target: 217.77.9.89/32

Classification: Low Risk

Date: June 14, 2026

---

## EXECUTIVE SUMMARY

IP 217.77.9.89 is a low-risk cloud infrastructure address hosted on Contabo (ASN 40021), classified as a web server. Risk score of 30/100 with no active threat indicators. Subnet 217.77.9.0/24 demonstrates minimal abuse density. No immediate blocking action recommended.

---

## INFRASTRUCTURE PROFILE

Provider: Contabo (CloudCompute infrastructure)

Organization: Johannes Selg

Infrastructure Type: Cloud Hosting / Web Server

ASN: 40021

BGP Prefix: 217.77.8.0/21

Bogon Status: Not bogon

---

## GEOLOCATION ANALYSIS

Reported Location: Germany (DE)

Confidence: Low (400km accuracy radius, geoPlausible: false)

Coordinates: 51.17°N, 10.45°E

Timezone: Europe/Berlin

*Note: Geolocation data shows inconsistencies between reported coordinates and RTT-based distance calculations. IP may be using geo-spoofing or located in a different region.*

---

## NETWORK SERVICES

Open Ports:

Port 22/SSH (SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.16)
Port 80/HTTP
Port 443/HTTPS
Port 8080/HTTP-Alt

TLS Configuration:

Protocol: TLS 1.3
Cipher Suite: TLS_AES_256_GCM_SHA384
Certificate Issuer: CloudFlare Origin SSL Certificate Authority
Subject: *.businesscloud.sh, businesscloud.sh
Certificate Authority: Cloudflare, Inc.

Server Banner: nginx

---

## DNS RESOLUTION

PTR Hostname: vmi2276244.contaboserver.net

Forward Resolution: vmi2276244.contaboserver.net (confirmed)

Hosted Domain Count: 0

---

## THREAT INTELLIGENCE

Risk Score: 30/100 (Low)

Known Attacker: No

Spam Source: No

Tor Exit Node: No

Blacklist Count: 0

Threat Feeds: None detected

Campaign Correlation: None

---

## OBSERVATION HISTORY

Total Observations: 22

Recent Activity: June 14, 2026

Key Findings:

TLS 1.3 enabled with strong cipher suite (AES-256-GCM)
HTTP/2.0 enabled
HTTP status code 502 observed (Bad Gateway)
SSH version: OpenSSH 9.6p1 Ubuntu
Some geolocation signal inconsistencies (RTT vs claimed location)

---

## SUBNET ANALYSIS

Subnet: 217.77.9.0/24

Abuse Density: 0

Classification: mostly_clean

Active Siblings: 1

Threat Siblings: 1

Risk Distribution: Evenly distributed across low/medium/high

---

## RELATIONSHIP GRAPH

Total Relationships: 55

Primary Associations:

DNS: vmi2276244.contaboserver.net (multiple entries)
Network: TT-20241110 (same network)

---

## RECOMMENDATIONS

Action: NO ACTION REQUIRED

Risk Level: Low (30/100)

The IP presents standard cloud infrastructure characteristics with no active malicious indicators. No firewall rules or blocking recommendations generated. Continue standard monitoring.

---

Status: Monitoring recommended. No immediate threat indicators present.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.

🌍 Geolocation

Country	🇩🇪 Germany
Region	Missouri
City	St Louis
Timezone	Europe/Berlin
Latitude	51.17
Longitude	10.45

🏢 Ownership & Registration

Organization	Johannes Selg
ASN	AS40021
Network Name	—
CIDR Block	—
RIR	RIPE
Country	—
Abuse Contact	Available via RDAP

🌐 DNS Intelligence

PTR	vmi2276244.contaboserver.net
Forward Confirmed	Yes — FCrDNS verified
Forward Hostnames	`vmi2276244.contaboserver.net`

🔐 DNS Hygiene

Hygiene Score	80% (Excellent)
SPF	1/2 domains
DMARC	1/2 domains
FCrDNS	Verified
DNSSEC	Valid
CAA	Not configured
Domains Checked	2 domains

☁️ Network Classification

Infrastructure	Infrastructure / Datacenter
Service Purpose	Web Server
Network Tier	Hosting — Infrastructure provider without advanced routing

CloudHosting

🔌 Services & Open Ports

Port	Service	Protocol	Banner
80	http	tcp	—
443	https	tcp	—
22	ssh	tcp	SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.16
8080	http-alt	tcp	—
Closed Ports	25, 3389, 8443 (4 open / 7 scanned)

Server	nginx
HTTP Title	—
SSH Version	SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.16

🔐 TLS Certificate

🔒

CN=CloudFlare Origin Certificate, OU=CloudFlare Origin CA, O="CloudFlare, Inc."

Issued by S=California, L=San Francisco, OU=CloudFlare Origin SSL Certificate Authority, O="CloudFlare, Inc.", C=US

Self-signed: No

SANs	*.businesscloud.shbusinesscloud.sh
Valid From	2025-08-19T05:34:00+00:00
Valid Until	2040-08-15T05:34:00+00:00
TLS Protocol	Tls13
Cipher Suite	TLS_AES_256_GCM_SHA384
Signature Algorithm	sha256RSA
Validity Period	5475 days
Serial Number	66DA5077B2D25FDFE819FC321531C80E1F15CAF2
Thumbprint	AA04F97845361263B6DBF15A0A504FC76C6E1E5A

🎯 Confidence Breakdown

Per-dimension confidence scores based on source diversity and data freshness

Dimension	Score	Sources	Observations
threat	31%	2	4
routing	8%	1	1
services	28%	2	3
ownership	20%	2	3
reputation	28%	1	3
geolocation	35%	2	3
Overall	25%	10	17

Coverage: 6/6 dimensions · Data sufficiency: sufficient

Data Coherence	Mostly Consistent (80%) — 1 contradiction(s)
Attribution	Moderate (55%)
	OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid

⚠ Claimed geolocation contradicts RTT physics measurement

📅 Observation Timeline 🔄 Live

First Seen	2026-05-10 04:11:50 UTC
Last Seen	2026-06-27 17:02:21 UTC
Profile Built	2026-06-28 11:08:28 UTC
Data Freshness	Live
Signal Types	23
Total Observations	29

🔍 23 signal types · 29 observations collected

This report is generated from 23+ independent intelligence signals including ownership records, DNS analysis, BGP routing, TLS certificates, port scanning, threat feeds, behavioral fingerprinting, and more.
Full dossier details are available via our API.

{ } JSON API 🔧 Actions API 📧 Enterprise Access

ℹ️ About This Report

All data shown is publicly available network metadata — IP addresses do not reliably identify individuals. Assessments are probabilistic and should not be used as sole basis for access control decisions. To report an issue or request data review, contact admin@ipdebrief.com.

217.77.9.89📋 Copy