# 87.122.26.16 — IP Intelligence Summary

87.122.26.16 is an IPv4 address operated by 1&1 Versatel GmbH (AS8881), geolocated to Bottrop, Germany. As of September 5, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/87.122.26.16
- Last updated: 2026-09-05

## Ownership

- Organization: 1&1 Versatel GmbH
- Network name: DE-VERSATEL-20050727
- Allocated block: 87.122.0.0/15
- ASN: AS8881 (https://ipdebrief.com/asn/8881)
- Regional registry: RIPE

## Location

- City: Bottrop
- Region: NW
- Country: Germany
- Time zone: Europe/Berlin

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (40/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# INTELLIGENCE BRIEFING: 87.122.26.16

**Classification:** LOW RISK | **Date:** 2026-07-28 | **Analyst:** IPDebrief SOC Team

\---

\## EXECUTIVE SUMMARY

IP address 87.122.26.16/32 is assessed as **LOW RISK** with a risk score of 15/100. The IP belongs to 1&1 Versatel GmbH (ASN 8881) in Witten, North Rhine-Westphalia, Germany. No active threat indicators, blacklisting, or malicious campaigns were detected. The IP serves as a firewalled host with no open services detected.

\---

\## NETWORK OWNERSHIP & GEOLOCATION

| Attribute | Value |

|-----------|-------|

| **Organization** | 1&1 Versatel GmbH |

| **ASN** | 8881 |

| **Netname** | DE-VERSATEL-20050727 |

| **CIDR Block** | 87.122.0.0/15 |

| **Country** | Germany (DE) |

| **City** | Witten |

| **Region** | North Rhine-Westphalia |

| **Coordinates** | 51.17°N, 10.45°E |

| **RIR** | RIPE |

**Geolocation Confidence:** Validated (geo_plausible: true, geo_consensus: true)

\---

\## THREAT ASSESSMENT

\### Current Risk Profile

\- **Risk Score:** 15 (Low Risk)

\- **Abuse Confidence:** Not applicable

\- **Blacklist Count:** 0

\- **Known Attacker:** No

\- **Tor Exit Node:** No

\- **Spam Source:** No

\### Control Plane Indicators

\- **DNSBL Listings:** 1 of 8 total lists

\- **Operator Score:** 0.1304 (Minimal)

\- **Route Stability:** False (route changes detected in 30-day window)

\- **RPKI State:** Not reported

\- **IRRC Consistency:** Not reported

\---

\## NETWORK SERVICES & DNS

\### Service Enumeration

\- **Open Ports:** None detected

\- **TLS Certificate:** Not present

\- **HTTP Banner:** Not present

\- **Server Classification:** Firewalled / No Services

\### DNS Resolution

\- **PTR Hostnames:** None

\- **Forward Resolution:** Failed

\- **Hosted Domains:** 0

\- **Email Authentication:** SPF/DMARC not configured

\---

\## NEIGHBORHOOD ANALYSIS (87.122.26.0/24)

**Subnet Classification:** mostly_clean

| Metric | Value |

|--------|-------|

| **Total Siblings** | 4 |

| **Active Siblings** | 2 |

| **Threat Siblings** | 1 |

| **Abuse Density** | 0.25 |

| **Inherited Risk** | 2 |

**Neighbor Risk Distribution:**

\- High Risk: 0

\- Medium Risk: 2 (87.122.26.143, 87.122.26.226 - both risk score 40)

\- Low Risk: 1 (87.122.26.103 - risk score 15)

\---

\## OBSERVATION HISTORY

**Total Observations:** 15 signals

**Recent Activity (2026-07-28):**

\- **Geolocation Signals:** Validated Germany coordinates with 0.52 confidence

\- **Network Classification:** Confirmed non-hosting, non-proxy, non-CDN, non-Tor infrastructure

\- **Ownership Stability:** 0 ownership changes recorded

\- **Threat Persistence:** 0 days (not persistently malicious)

\- **Operator Score:** 0.1304 (Minimal)

**Temporal Indicators:**

\- **Threat Observation Count:** 0

\- **Ownership Changes:** 0

\- **Persistence Days:** 0

\- **Status:** Not persistently malicious

\---

\## RELATIONSHIP GRAPH

The IP maintains associations primarily with the network namespace DE-VERSATEL-20050727. No external hostnames, organizations, or certificates were identified in the relationship graph.

\---

\## RECOMMENDED ACTIONS

**Current Risk Score:** 15 (Low Risk)

**Recommended Actions:** None at this time. No firewall rules or blocking actions recommended based on current threat profile.

**Context:** The IP shows no active malicious indicators. Monitoring should continue to validate ongoing low-risk behavior.

\---

\## ANALYST NOTES

This IP address demonstrates consistent, benign characteristics typical of a legitimate hosting or enterprise infrastructure node. The absence of open services, combined with firewalled status and lack of threat indicators, suggests normal operational behavior. The single DNSBL listing requires contextual review but does not indicate active malicious use at this time.

**Confidence Level:** High (based on 15 signal observations and validated geolocation)

**Next Review:** Standard periodic monitoring recommended.

## Nearby addresses

- 87.122.26.103 (https://ipdebrief.com/87.122.26.103)
- 87.122.26.143 (https://ipdebrief.com/87.122.26.143)
- 87.122.26.226 (https://ipdebrief.com/87.122.26.226)

---

Source: IPDebrief, "87.122.26.16 IP intelligence", https://ipdebrief.com/87.122.26.16, updated 2026-09-05. Assessments are probabilistic.