5.189.176.170📋 Copy

# INTELLIGENCE BRIEFING: 5.189.176.170/32

Classification: LOW RISK / WEB HOSTING INFRASTRUCTURE

Date of Analysis: 2026-06-20

Primary Data Source: IPDebrief Intelligence Platform

---

## EXECUTIVE SUMMARY

IP 5.189.176.170 is a low-risk web server operating within the Contabo cloud computing infrastructure in Germany. The address exhibits standard hosting characteristics with Apache-based web services and SSH access. Risk assessment yields a score of 25 (Low Risk), with one DNSBL listing out of 8 total lists. The IP demonstrates stable network routing with no evidence of persistent malicious activity.

---

## OWNERSHIP & INFRASTRUCTURE

Organization: Johannes Selg

ASN: 51167 (Johannes Selg, RIPE NCC)

Provider: Contabo

Infrastructure Type: Cloud Computing

Location: Nuremberg, Germany (51.17°N, 10.45°E)

CIDR Block: 5.189.176.0/20

Registration Date: 2010-06-11 (ASN allocated)

The IP is hosted on Contabo's cloud infrastructure, indicated by the hostname vmi2890222.contaboserver.net. The BGP path demonstrates stable routing (2152 → 3356 → 51167) with route stability confirmed.

---

## NETWORK SERVICES & FINGERPRINTING

Open Ports:

• Port 80/TCP: HTTP (Apache 2.4.58)
• Port 443/TCP: HTTPS (OpenSSL 1.1.1w, PHP 8.2.12)
• Port 22/TCP: SSH (OpenSSH 9.6p1 Ubuntu-3ubuntu13.16)

Web Server Details:

• Server Banner: Apache/2.4.58 (Unix) OpenSSL/1.1.1w PHP/8.2.12
• TLS Certificate: Self-signed, issued by Apache Friends Berlin
• HTTP Status: 302 (Redirect) observed in recent scans
• HTTP Version: 1.1

DNS Resolution:

• PTR Record: vmi2890222.contaboserver.net
• Forward Resolution: Confirmed
• DNSSEC: Valid
• No SPF/DMARC records configured

---

## THREAT ASSESSMENT

Overall Risk Score: 25 (Low Risk)

Reputation: Low Risk

Abuse Confidence Score: Not applicable

Known Attacks/Indicators: None detected

Blacklist Status: 1 of 8 DNSBLs

Tor Exit Node: No

Known Attacker: No

Spam Source: No

Threat Indicators:

• No active threat indicators
• No known campaigns associated
• No persistent malicious behavior observed
• Threat observation count: 1

---

## NEIGHBORHOOD ANALYSIS

Subnet: 5.189.176.0/24

Abuse Density: 1 (Low)

Classification: Mostly Clean

Inherited Risk: 2

Total Sibling IPs: 1

Active Siblings: 1

Threat Siblings: 1

The subnet demonstrates minimal abuse activity with a single threat sibling IP. The overall neighborhood classification supports the low-risk assessment for this address.

---

## OBSERVATION HISTORY

Total Observations: 28 signals

Recent Activity: 2026-06-20 (most recent observations)

Temporal Trends:

• HTTP headers consistently show Apache 2.4.58 with PHP 8.2.12
• Geolocation signals confirm German origin (DE) with 52% confidence
• Operator score rated as Moderate (0.5217)
• No significant changes in service fingerprinting over observation period
• No ownership changes detected

Signal Types Observed:

• HTTP response headers and status codes
• Geolocation inference
• ASN and routing validation
• Operator and control plane scoring
• DNS and geolocation consistency checks

---

## RECOMMENDED ACTIONS

Firewall/Routing:

• Standard allow rules for ports 80, 443, and 22 (if legitimate traffic expected)
• No immediate blocking required based on current risk profile

Monitoring Recommendations:

• Monitor for changes in TLS certificate validity
• Track DNSBL listing status
• Observe for any emergence of threat indicators

Threat Hunting:

• No proactive threat hunting required at this time
• Review sibling IP 5.189.176.x if broader subnet investigation warranted

---

## INTELLIGENCE CONCLUSION

IP 5.189.176.170 represents standard cloud hosting infrastructure with no evidence of malicious activity. The address operates as a web server within Contabo's German data center infrastructure. Current risk profile supports continued monitoring without immediate mitigation actions. SOC teams should maintain awareness of the single DNSBL listing and track for any emergence of threat indicators.

Confidence Level: High

Next Review: Standard monitoring interval

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.