77.237.234.238📋 Copy

THREAT INTELLIGENCE BRIEFING

IP Address: 77.237.234.238/32

Date: 2026-06-14

Classification: Cloud Compute Infrastructure

Executive Summary

The IP address 77.237.234.238 is a cloud-hosted virtual machine instance operating on Contabo infrastructure (ASN 51167, RIPE). The asset presents low risk with a reputation score of 25/100. Current threat indicators show minimal malicious activity, with one DNSBL listing detected.

Ownership and Infrastructure

• Organization: Johannes Selg
• Provider: Contabo (Cloud Computing)
• ASN: 51167
• Country: DE (Germany)
• Geolocation: Benidorm (400km accuracy radius)
• Infrastructure Type: CloudCompute / Hosting
• PTR Hostname: vmi3170361.contaboserver.net

Network Characteristics

• Open Ports: TCP/80 (HTTP), TCP/22 (SSH)
• Server Fingerprint: nginx/1.14.0 (Ubuntu)
• HTTP Version: 1.1
• DNS Resolution: Forward confirmed to vmi3170361.contaboserver.net
• Email Authentication: SPF and DMARC records not configured

Threat Assessment

• Risk Score: 25 (Low Risk)
• Abuse Confidence: Not elevated
• Blacklist Status: Listed on 1 of 8 DNSBL feeds
• Known Campaigns: None detected
• Tor/Proxy/VPN: Not identified
• Threat Observation Count: 1

Observation History

Signal monitoring over the past 30 days indicates 25 observations with consistent provider classification (Contabo). The IP shows no persistent malicious behavior. Most recent observation (2026-06-14) confirms cloud infrastructure classification. Subnet abuse density classified as "mostly_clean" with one threat sibling in the /24.

Related Entities

• DNS Associations: 46 relationships all mapping to vmi3170361.contaboserver.net
• Subnet Neighbors: 77.237.234.0/24 - Abuse density: 0, Classification: mostly_clean
• BGP Prefix: 77.237.232.0/21

Security Recommendations

• Traffic Volume: Standard monitoring recommended due to cloud hosting nature
• SSH Access: Verify SSH port 22 is not exposed to unauthorized access
• DNSBL Monitoring: Investigate origin of single DNSBL listing if traffic patterns are anomalous
• Cloud Context: This is a standard cloud VMI; false positives expected for benign cloud traffic
• Firewall Rule: No specific blocking required at this time based on current risk profile

Conclusion

This IP represents standard Contabo cloud hosting infrastructure with minimal threat indicators. The single DNSBL listing warrants monitoring but does not indicate active malicious use. SOC analysts should treat as low-priority cloud infrastructure traffic unless anomalous behavior patterns emerge.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.