38.242.239.223📋 Copy

# IP Intelligence Briefing: 38.242.239.223/32

## Executive Summary

Target IP 38.242.239.223 is classified as Low Risk with an overall risk score of 25. The address is hosted on Contabo cloud infrastructure under Cogent Communications ASN 51167. No active threat indicators, known campaigns, or malicious reputation sources have been identified.

## Technical Profile

Ownership & Infrastructure

• ASN: 51167 (Cogent Communications, LLC)
• Provider: Contabo
• Infrastructure Type: Cloud Compute
• Network Role: Single-Service Host
• CIDR Block: 38.242.224.0/19

Geolocation

• Country: United States (US)
• Region: Grand Est
• City: Lauterbourg
• GeoSource Count: 1
• Geo Consensus: True

Network Services

• Open Ports: 22/tcp (SSH - OpenSSH_9.6p1 Ubuntu-3ubuntu13.16)
• Forward Resolution: vm2940078.contaboserver.net
• PTR Hostnames: vm2940078.contaboserver.net
• TLS Certificate: None detected

Reputation Indicators

• Risk Score: 25 (Low)
• DNSBL Listed: 1 of 8 total lists
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Abuse Confidence Score: Not available

Control Plane Status

• BGP Prefix: 38.242.224.0/19
• Route Stability: False
• RPKI State: Not available
• DNSSEC: Valid
• Delegation Age: Not available

## Observation History

Signal observation history contains 21 recorded observations as of 2026-06-20. Historical data indicates:

• Multiple geolocation signal types with varying confidence levels (0.35-0.70)
• Routing and ownership classification signals
• Network classification consistently identifying as cloud/hosting infrastructure
• No persistent threat behavior observed

## Relationship Graph

37 relationships identified including:

• DNS Associations: vm2940078.contaboserver.net (multiple entries)
• Network Associations: COGENT-A network
• Correlated Entities: No known malicious relationships

## Neighborhood Analysis

• Subnet: 38.242.239.223/24
• Abuse Density: 0
• Total Siblings: 1
• Active Siblings: 1
• Threat Siblings: 1
• Classification: Mostly Clean
• Inherited Risk: 2

## Risk Assessment

The IP address presents minimal risk to network defenses. Classification as "mostly_clean" with zero abuse density in the /24 subnet indicates legitimate cloud hosting usage. The single DNSBL listing requires contextual evaluation but does not indicate active malicious activity.

## Recommended Actions

No firewall rules or blocking actions recommended at this time. The IP's risk profile (score 25) falls below standard blocking thresholds. Continue standard monitoring protocols for cloud hosting infrastructure.

## Intelligence Confidence

High – Data sourced from comprehensive IP reputation databases, geolocation services, and network scanning infrastructure. Multiple signal types corroborate the low-risk classification.

---

*Report generated: 2026-06-20*

*Classification: SOC Intelligence*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.