80.190.73.75📋 Copy

## IP INTELLIGENCE BRIEFING: 80.190.73.75/32

Date: 2026-08-06

IP Address: 80.190.73.75/32

Classification: Moderate Risk (Score: 50/100)

---

EXECUTIVE SUMMARY

IP 80.190.73.75 is a German-based cloud hosting infrastructure asset operated by Contabo (AS40021). The IP is associated with a VPS instance (vmi3448239.contaboserver.net) within the 80.190.72.0/21 CIDR block. While no active threat indicators were detected, the IP's geolocation signals show inconsistency and one historical signal flagged it as a compromised proxy server. The subnet exhibits zero abuse density with no neighboring high-risk activity.

---

OWNERSHIP & INFRASTRUCTURE

Network Classification: Cloud hosting provider infrastructure with no publicly accessible services detected (firewalled/no services).

---

GEOLOCATION ANALYSIS

Primary Location: Germany (DE)

Coordinates: 51.17°N, 10.45°E (Munchen region)

GeoConsensus: Inconsistent signals detected

Signal Discrepancies:

• RIR registration data indicates Munich, Germany
• MaxMind GeoLite2 signals placed the IP at 51.2993°N, 9.491°E (near Paris, France)
• GeoPlausible validation: false
• Accuracy radius: 400km

Assessment: Geolocation inconsistencies warrant monitoring for potential misconfiguration or routing anomalies.

---

THREAT INTELLIGENCE

Current Threat Indicators: None detected

Blacklist Count: 0

Abuse Confidence Score: Not available

Known Campaigns: None correlated

Historical Signals (16 observations):

• One proxycheck-io signal (2026-08-06) classified IP as "Compromised Server" with 100 risk score
• Multiple geolocation signals showing European origin (Germany/France)
• ASN AS40021 consistently identified across observations

Campaign Correlation: No certificate matches, banner matches, or correlated IPs detected.

---

NETWORK RELATIONSHIPS

DNS Associations: vmi3448239.contaboserver.net (6 relationship entries)

Network Associations: TT-20230316 (2 relationship entries)

Total Relationships: 6

DNS Configuration:

• PTR Record: vmi3448239.contaboserver.net
• Forward Resolution: Confirmed
• Email Authentication: SPF/DMARC not configured (not applicable for hosting infrastructure)

---

SUBNET ANALYSIS

Subnet: 80.190.73.75/24

Abuse Density: 0 (No abuse activity detected)

Neighbor Count: 0

Risk Distribution:

• High Risk: 0
• Medium Risk: 0
• Low Risk: 0

Assessment: No malicious activity detected within the immediate /24 subnet. The IP appears isolated from neighboring abuse activity.

---

CONTROL PLANE DATA

---

RECOMMENDED ACTIONS

Risk Score: 50/100 (Moderate Risk)

Recommendation: Monitor or block depending on organizational policy

Firewall Rules:

```

iptables: iptables -A INPUT -s 80.190.73.75 -j DROP

nftables: nft add rule inet filter input ip saddr 80.190.73.75 drop

nginx: deny 80.190.73.75;

```

Cloud Platform Rules:

• Cloudflare WAF: Block expression `ip.src eq 80.190.73.75`
• AWS WAF: Address `80.190.73.75/32`

Action Rationale: The IP's historical classification as a compromised proxy server (proxycheck-io) combined with geolocation inconsistencies suggests potential abuse. However, current threat indicators are absent. Decision should be based on threat context and organizational risk tolerance.

---

INTELLIGENCE GAP ANALYSIS

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.