31.220.89.135📋 Copy

# IP Intelligence Briefing: 31.220.89.135/32

## Executive Summary

IP address 31.220.89.135 is classified as Moderate Risk (Risk Score: 50), hosted on Contabo cloud infrastructure (ASN 51167). The IP is registered to Johannes Selg under network TT-20230217 (31.220.88.0/21). No active threat indicators were observed, but geolocation inconsistencies and cloud hosting characteristics warrant monitoring.

---

## Network Classification & Ownership

The IP is confirmed as a cloud-hosted virtual machine with the hostname vmi1495408.contaboserver.net. Forward and reverse DNS resolution are consistent.

---

## Threat Profile

• Risk Score: 50 (Moderate)
• Threat Indicators: None detected
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0
• Campaign Correlation: None

No evidence of malicious activity in current threat feeds. The IP does not appear in known threat campaigns or attacker databases.

---

## Services & Network Footprint

The IP operates standard web server services with SSH access enabled, typical for cloud VMI hosting.

---

## Geolocation Analysis

Current Classification: DE (Germany)

• Region: VC
• City: Pedreguer
• Coordinates: 51.17°N, 10.45°E
• Geo-Consensus: False (inconsistent sources)

Historical Discrepancy: 2026-08-05 observation recorded geolocation as ES (Spain) via Alienvault OTX with associated threat signals. This geolocation inconsistency is notable for cloud infrastructure.

---

## Neighborhood Assessment

Subnet: 31.220.89.0/24

• Abuse Density: 0% (Clean)
• Total Siblings: 4 (3 active)
• Neighbor Risk Distribution:

- 31.220.89.60: Risk Score 25

- 31.220.89.126: Risk Score 25

- 31.220.89.176: Risk Score 25

No threat siblings detected in the /24 subnet. Neighborhood exhibits clean classification with low-risk peers.

---

## Historical Observations (25 Total Signals)

Recent monitoring shows:

• 2026-08-05: Connection failures observed (HTTPS)
• 2026-08-05: Spain geolocation with 3 threat pulses (Alienvault OTX)
• 2026-08-05: Paris, France hop via Colt network infrastructure
• Operator Score: 0.4348 (Basic)

Signals indicate transient connection issues and geographic attribution conflicts, consistent with cloud hosting patterns. No persistent malicious behavior observed.

---

## Control Plane Status

• BGP Prefix: 31.220.88.0/21
• Route Stability: False (not route-stable)
• Route Changes (30d): 0
• RPKI State: Not validated
• DNSSEC: Valid
• DNSBL Listed: 2 of 8 total lists

---

## Recommended Security Actions

Despite moderate risk classification, no specific threat indicators were identified. Blocking is not recommended based solely on this profile. However, the following rules are provided for review:

Firewall Rules

• iptables: `iptables -A INPUT -s 31.220.89.135 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 31.220.89.135 drop`
• nginx: `deny 31.220.89.135;`
• Cloudflare WAF: Block with expression `ip.src eq 31.220.89.135`
• AWS WAF: Block address `31.220.89.135/32`

Recommendation: Monitor but do not block. The IP operates as legitimate cloud infrastructure with no current threat indicators. Consider blocking only if specific attack activity is observed from this address.

---

## Intelligence Conclusion

31.220.89.135 is a Contabo cloud VMI with moderate risk classification but no active malicious indicators. Geolocation inconsistencies require awareness but do not confirm compromise. The subnet exhibits clean characteristics with low-risk neighbors. Standard monitoring practices are appropriate without immediate blocking action.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.