5.189.130.40📋 Copy

INTELLIGENCE BRIEFING: 5.189.130.40/32

EXECUTIVE SUMMARY

IP 5.189.130.40 presents as a low-risk cloud infrastructure endpoint associated with Contabo hosting provider. The IP is classified as a virtual machine instance with no active services, no open ports, and no known threat indicators. Current risk assessment scores 25/100 (Low Risk).

NETWORK OWNERSHIP & INFRASTRUCTURE

• ASN: 51167 (Johannes Selg)
• Provider: Contabo (CloudCompute infrastructure)
• Infrastructure Type: Cloud hosting environment
• Geolocation: Germany (DE), Lauterbourg, Grand Est region
• CIDR Block: 5.189.128.0/20 (BGP prefix)
• Routing Status: Route changes observed in past 30 days

THREAT ASSESSMENT

• Risk Score: 25 (Low Risk)
• Abuse Confidence Score: Not applicable
• Blacklist Status: Listed on 1 of 8 DNSBLs
• Known Threats: None identified

- Not a known attacker

- Not a spam source

- Not a Tor exit node

- No threat feed matches

• Threat Persistence: 0 days (no persistent malicious activity)

NETWORK ROLE & CLASSIFICATION

• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• DNS: vmi3017455.contaboserver.net (forward confirmed)
• Infrastructure: Cloud hosting environment with virtual machine hostname pattern (vmi* = virtual machine instance)

NEIGHBORHOOD ANALYSIS

• Subnet: 5.189.130.40/24
• Abuse Density: 0.5 (moderate neighborhood risk)
• Classification: Mostly Clean
• Total Siblings: 2
• Active Siblings: 0
• Threat Siblings: 1
• Inherited Risk: 2/100
• Neighbor IP: 5.189.130.46 (Risk Score: 25, Authority Score: 60)

OBSERVATION HISTORY

• Total Observations: 17 signals recorded
• Most Recent: 2026-06-20T16:45:40 UTC
• Signal Trends:

- Subnet abuse density consistently 0.5

- Classification stable at "mostly_clean"

- Operator score: 0.2609 (Basic classification)

- Geolocation confidence: 0.52 (moderate confidence)

RECOMMENDED ACTIONS

• Firewall Policy: Allow (low risk)
• Monitoring Priority: Low
• Threat Hunting: No immediate action required
• Note: IP represents a standard cloud hosting VM instance with no active services. The single DNSBL listing appears to be a false positive given the low-risk profile and absence of threat indicators.

INTELLIGENCE CONFIDENCE: HIGH

Data sources include full IP profile, neighborhood analysis, relationship graph, and 17 historical observations. The IP exhibits characteristics typical of benign cloud infrastructure hosting.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.