## Intelligence Briefing: 86.48.30.101/32
Classification: LOW RISK – Cloud Infrastructure Endpoint
Assessment Date: 2026-07-22
Analyst: IPDebrief SOC Intelligence Unit
---
Executive Summary
IP address 86.48.30.101 is a low-risk cloud computing endpoint belonging to Contabo (ASN: 40021, Organization: Johannes Selg, Netname: TT-20220523). The asset operates within the 86.48.16.0/20 CIDR block under RIPE NCC. Current risk score is 25, with no active threat indicators or malicious activity observed. No actionable firewall rules required.
---
Ownership and Infrastructure Profile
| Attribute | Value |
|---|---|
| **ASN** | 40021 (Contabo) |
| **Organization** | Johannes Selg |
| **Netname** | TT-20220523 |
| **CIDR Block** | 86.48.16.0/20 |
| **RIR** | RIPE |
| **Infrastructure Type** | CloudCompute |
| **Classification** | Firewalled / No Services |
Geolocation:
- Country: United States (US)
- Region/City: New York / Orangeburg
- Coordinates: 41.0446°N, -73.9592°W
- Geolocation Confidence: 0.70 (MaxMind GeoLite2)
- Note: Geolocation data shows some variance; consensus indicates US-based deployment
---
Network Behavior and Services
- Open Ports: None detected (firewalled)
- DNS PTR Record: vmi3341387.contaboserver.net
- Forward Resolution: vmi3341387.contaboserver.net (1 hostname)
- TLS Certificates: None
- HTTP Services: None active
- Service Purpose: CloudCompute Infrastructure (No Services)
Network Classification Flags:
- Cloud Infrastructure: ✓ Active
- CDN: ✗ Inactive
- VPN: ✗ Inactive
- Proxy: ✗ Inactive
- Tor Exit: ✗ Inactive
- Hosting: ✓ Active
- Mobile/Residential: ✗ Inactive
---
Threat Indicators and Reputation
| Metric | Value | Status |
|---|---|---|
| **Risk Score** | 25 | LOW |
| **Abuse Confidence Score** | N/A | N/A |
| **Blacklist Count** | 0 | Clean |
| **DNSBL Listed** | 1 of 8 lists | Minimal |
| **Is Known Attacker** | false | Clean |
| **Is Spam Source** | false | Clean |
| **Tor Exit Node** | false | Clean |
| **Campaign Matches** | 0 | None |
Threat Feeds: No indicators in Pulsedive or other threat feeds.
---
Neighborhood Analysis
Subnet: 86.48.30.101/24
- Abuse Density: 0 (Clean)
- Classification: Clean
- Inherited Risk: 0
- Total Siblings: 1
- Active Siblings: 0
- Threat Siblings: 0
The /24 subnet demonstrates no malicious activity. No neighboring IPs flagged for abuse or threat.
---
Relationship Graph
Identified Associations:
- DNS Hostnames: vmi3341387.contaboserver.net (3 associations)
- Network Blocks: TT-20220523 (3 associations)
All relationships indicate standard cloud infrastructure DNS and network block associations. No unusual or suspicious connections identified.
---
Historical Observation Trends
Total Observations: 20 signals tracked
Recent Activity (2026-07-22):
- Geolocation updates: Orangeburg, New York (US)
- Operator score: Basic (0.2609)
- Subnet classification: Clean
- Ownership: Stable (0 changes)
- Threat persistence: 0 days
- Threat observations: 0
Temporal Assessment: No evidence of malicious activity over observation period. IP maintains stable ownership and clean classification.
---
Control Plane and Routing
| Metric | Value |
|---|---|
| **Origin ASN** | 40021 |
| **BGP Prefix** | 86.48.28.0/22 |
| **Route Stability** | Not stable |
| **Route Changes (30d)** | 0 |
| **RPKI State** | Not assessed |
| **DNSSEC Valid** | true |
| **Hop Count (Traceroute)** | 30 hops |
| **Transit Networks** | Comcast, Lumen |
---
Recommended Actions
Current Risk Profile: LOW RISK (Score: 25)
Actionable Recommendations: None required at this time.
Firewall Rules: No blocking or filtering rules recommended.
SOC Guidance:
- No immediate action required
- IP represents legitimate cloud infrastructure with no malicious indicators
- Standard monitoring protocols apply
- No evidence of abuse or threat activity
---
Conclusion
IP address 86.48.30.101 is a Contabo cloud computing endpoint with no active threat indicators. The asset demonstrates clean reputation metrics, no blacklist associations, and operates within a low-abuse-density subnet. Historical data confirms persistent benign behavior. This IP warrants standard network monitoring but does not require special threat handling or blocking actions.
Confidence Level: High (comprehensive profile, clean history, no threat indicators)
Last Updated: 2026-07-22
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Johannes Selg |
| ASN | AS40021 |
| Network Name | TT-20220523 |
| CIDR Block | 86.48.16.0/20 |
| RIR | RIPE |
| Country | US |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | vmi3341387.contaboserver.net |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | vmi3341387.contaboserver.net |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Web Server |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| 22 | ssh | tcp | Banner detected |
| Closed Ports | 25, 3389, 8080, 8443 (3 open / 7 scanned) | ||
| Server | Web server detected |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🛡️ Public Network Snapshot
| Origin ASN | AS40021 |
| Network Prefix | 86.48.28.0/22 |
| Route mapping | Found |
| Certificates in transparency logs | 0 certificates |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 43% | 2 | 5 |
| routing | 8% | 1 | 1 |
| services | 24% | 2 | 3 |
| ownership | 20% | 2 | 3 |
| reputation | 22% | 1 | 3 |
| geolocation | 27% | 2 | 3 |
| Overall | 24% | 10 | 18 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (70%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-02 04:22:19 UTC |
| Last Seen | 2026-08-27 14:52:53 UTC |
| Profile Built | 2026-08-29 04:19:12 UTC |
| Data Freshness | Live |
| Signal Types | 26 |
| Total Observations | 28 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 86.48.30.101
Who owns the IP address 86.48.30.101?
86.48.30.101 is registered to Johannes Selg. The address falls within the 86.48.16.0/20 network block. Registration is held at RIPE.
Where is 86.48.30.101 located?
Geolocation data places 86.48.30.101 in Orangeburg, New York, United States. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 86.48.30.101 malicious or safe?
86.48.30.101 currently carries a low risk assessment, meaning no significant threat indicators have been observed. This assessment is generated from continuously collected signals and can change over time.
What is the hostname for 86.48.30.101?
The reverse DNS (PTR) record for 86.48.30.101 is vmi3341387.contaboserver.net. This hostname is forward-confirmed, meaning it resolves back to the same address.
What ports are open on 86.48.30.101?
Responsive ports observed on 86.48.30.101 include 80, 443, 22. Port visibility reflects the most recent scan and may change as the host's configuration or firewall rules change.
Is 86.48.30.101 a VPN, proxy, or data center address?
86.48.30.101 is classified as cloud infrastructure and hosting infrastructure based on network ownership and behavioural analysis.