75.119.156.20📋 Copy

# IP Intelligence Briefing: 75.119.156.20/32

Classification: LOW RISK

Date: 2026-06-21

Analyst: IPDebrief Intelligence

---

## Executive Summary

IP 75.119.156.20 is a low-risk cloud infrastructure endpoint hosted by CONTABO (AS51167) in Düsseldorf, Germany. The address demonstrates consistent operational behavior with no active threat indicators. Risk assessment score: 25/100.

---

## Ownership & Infrastructure

---

## Network Role & Services

• Role: Cloud VPS / Web Server
• Open Ports: 80 (HTTP), 443 (HTTPS)
• Web Server: nginx/1.28.0
• Application Stack: Next.js
• TLS Certificate: Let's Encrypt (CN=app.techtots.edu.gh)
• Security Features: HSTS enabled, HTTP/2 disabled, Content-Type header protection active

---

## Threat Indicators

Current Status: CLEAN

---

## Neighborhood Analysis (75.119.156.0/24)

• Abuse Density: 0.5 (Low)
• Classification: mostly_clean
• Total Siblings: 2
• Active Siblings: 0
• Threat Siblings: 1
• Neighbor IP: 75.119.156.116 (Risk: 25)

The subnet demonstrates minimal abuse activity with a single threat-related sibling IP identified.

---

## Observation History (25 Signals)

Temporal Pattern: Consistent cloud infrastructure behavior observed since June 16, 2026.

Key Observations:

• June 21, 2026: DNS resolution to edu.gh domain, SPF/DMARC records present
• June 16, 2026: Full service fingerprinting completed

- TLS 1.3 with TLS_AES_256_GCM_SHA384 cipher

- Server response time: 945ms average

- HSTS header: max-age=31536000; includeSubDomains

- Same-origin policy: SAMEORIGIN

- X-Content-Type-Options: nosniff

Stability Assessment: No ownership changes detected. Infrastructure classified as persistently benign.

---

## Relationship Graph

Total Relationships: 26

• Network Associations: 13 unique CONTABO network references
• DNS Associations: 9 references to vmi2818997.contaboserver.net

No anomalous external relationships detected. All associations confirm legitimate cloud hosting infrastructure.

---

## Recommended Actions

Firewall/Security Rules: No blocking required. IP demonstrates benign operational patterns.

Monitoring Recommendations:

• Maintain passive observation for continued low-risk classification
• Monitor for any sudden risk score escalation
• Track DNSBL list additions if any occur

---

## Conclusion

IP 75.119.156.20 represents a standard cloud hosting endpoint with minimal security risk. The address shows consistent operational behavior, proper security headers, and no threat indicators. SOC teams may treat as benign but should maintain standard monitoring practices for cloud infrastructure.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.