87.122.26.16📋 Copy

# INTELLIGENCE BRIEFING: 87.122.26.16

Classification: LOW RISK | Date: 2026-07-28 | Analyst: IPDebrief SOC Team

---

## EXECUTIVE SUMMARY

IP address 87.122.26.16/32 is assessed as LOW RISK with a risk score of 15/100. The IP belongs to 1&1 Versatel GmbH (ASN 8881) in Witten, North Rhine-Westphalia, Germany. No active threat indicators, blacklisting, or malicious campaigns were detected. The IP serves as a firewalled host with no open services detected.

---

## NETWORK OWNERSHIP & GEOLOCATION

Geolocation Confidence: Validated (geo_plausible: true, geo_consensus: true)

---

## THREAT ASSESSMENT

Current Risk Profile

• Risk Score: 15 (Low Risk)
• Abuse Confidence: Not applicable
• Blacklist Count: 0
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No

Control Plane Indicators

• DNSBL Listings: 1 of 8 total lists
• Operator Score: 0.1304 (Minimal)
• Route Stability: False (route changes detected in 30-day window)
• RPKI State: Not reported
• IRRC Consistency: Not reported

---

## NETWORK SERVICES & DNS

Service Enumeration

• Open Ports: None detected
• TLS Certificate: Not present
• HTTP Banner: Not present
• Server Classification: Firewalled / No Services

DNS Resolution

• PTR Hostnames: None
• Forward Resolution: Failed
• Hosted Domains: 0
• Email Authentication: SPF/DMARC not configured

---

## NEIGHBORHOOD ANALYSIS (87.122.26.0/24)

Subnet Classification: mostly_clean

Neighbor Risk Distribution:

• High Risk: 0
• Medium Risk: 2 (87.122.26.143, 87.122.26.226 - both risk score 40)
• Low Risk: 1 (87.122.26.103 - risk score 15)

---

## OBSERVATION HISTORY

Total Observations: 15 signals

Recent Activity (2026-07-28):

• Geolocation Signals: Validated Germany coordinates with 0.52 confidence
• Network Classification: Confirmed non-hosting, non-proxy, non-CDN, non-Tor infrastructure
• Ownership Stability: 0 ownership changes recorded
• Threat Persistence: 0 days (not persistently malicious)
• Operator Score: 0.1304 (Minimal)

Temporal Indicators:

• Threat Observation Count: 0
• Ownership Changes: 0
• Persistence Days: 0
• Status: Not persistently malicious

---

## RELATIONSHIP GRAPH

The IP maintains associations primarily with the network namespace DE-VERSATEL-20050727. No external hostnames, organizations, or certificates were identified in the relationship graph.

---

## RECOMMENDED ACTIONS

Current Risk Score: 15 (Low Risk)

Recommended Actions: None at this time. No firewall rules or blocking actions recommended based on current threat profile.

Context: The IP shows no active malicious indicators. Monitoring should continue to validate ongoing low-risk behavior.

---

## ANALYST NOTES

This IP address demonstrates consistent, benign characteristics typical of a legitimate hosting or enterprise infrastructure node. The absence of open services, combined with firewalled status and lack of threat indicators, suggests normal operational behavior. The single DNSBL listing requires contextual review but does not indicate active malicious use at this time.

Confidence Level: High (based on 15 signal observations and validated geolocation)

Next Review: Standard periodic monitoring recommended.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.