86.48.3.14📋 Copy

IP INTELLIGENCE BRIEFING: 86.48.3.14/32

Classification: MODERATE RISK

Risk Score: 50/100

Date: 2026-08-13

---

EXECUTIVE SUMMARY

IP 86.48.3.14 is a German-origin cloud server associated with Contabo hosting infrastructure. The IP presents moderate risk with a risk score of 50. While no active malicious indicators were detected, the IP is listed on 2 of 8 total DNSBLs with high-severity ratings. The subnet shows low abuse density (0.25), classifying as "mostly clean" with minimal threat activity among sibling IPs.

OWNERSHIP & GEOLOCATION

• Organization: Johannes Selg (TT-20220721)
• ASN: 51167 (Contabo)
• Country: Germany (DE)
• Location: Lauterbourg, Grand Est
• CIDR: 86.48.0.0/22
• Geolocation Consensus: Inconsistent (2 sources, non-consensus)

NETWORK ROLE & SERVICES

• Infrastructure Type: Cloud Compute (Contabo)
• Service Purpose: Web Server / Hosting
• Open Ports: 80/22/443/8443 (TCP)
• Web Server: Nginx
• SSH Version: OpenSSH_9.6p1 Ubuntu-3ubuntu13.18
• Reverse DNS: vmi3391619.contaboserver.net

THREAT INDICATORS

• Abuse Confidence: Not applicable
• Blacklist Status: Listed on 2 of 8 DNSBLs (high severity)
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Campaigns: None detected

NEIGHBORHOOD ANALYSIS (86.48.3.0/24)

• Abuse Density: 0.25 (Low)
• Total Siblings: 4
• Active Siblings: 4
• Threat Siblings: 1
• Neighbor Risk Distribution: 3 low-risk (scores 25-30), 0 medium/high

OBSERVATION HISTORY

• Total Observations: 19
• Recent Activity: Connection attempts, TLS certificate scans, blacklist monitoring
• Threat Persistence: None
• Malicious Persistence: No persistent malicious behavior detected

RELATIONSHIPS

• Network Association: TT-20220721
• DNS Hostnames: vmi3391619.contaboserver.net (Contabo VPS)

---

ASSESSMENT

This IP represents a standard cloud-hosted web server with moderate risk classification. The presence of SSH access and multiple HTTPS ports is typical for web hosting infrastructure. While listed on some DNSBLs with high severity, the lack of active threat indicators and low neighborhood abuse density suggests the listings may be related to past activity or false positives. The single threat sibling in the /24 subnet warrants monitoring but does not indicate coordinated malicious activity.

RECOMMENDATIONS

• Monitor for increased DNSBL listings or risk score escalation
• Review incoming connections from this IP range if not expected
• Standard inbound filtering recommended for SSH (port 22)

---

*Intel generated via IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.