# 88.130.153.220 — IP Intelligence Summary 88.130.153.220 is an IPv4 address operated by 1&1 Versatel GmbH (AS8881), geolocated to Essen, Germany. As of October 5, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/88.130.153.220 - Last updated: 2026-10-05 ## Ownership - Organization: 1&1 Versatel GmbH - Network name: DE-VERSATEL-20051018 - Allocated block: 88.130.0.0/16 - ASN: AS8881 (https://ipdebrief.com/asn/8881) - Regional registry: RIPE ## Location - City: Essen - Region: North Rhine-Westphalia - Country: Germany - Time zone: Europe/Berlin ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Moderate Risk (40/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative \# IP Intelligence Briefing: 88.130.153.220/32 **Classification:** Moderate Risk **Date:** Analysis based on current signal data **Reporting:** SOC Intelligence Unit \--- \## Executive Summary IP address 88.130.153.220 is registered to 1&1 Versatel GmbH (ASN 8881) within the 88.130.0.0/16 network block in Essen, North Rhine-Westphalia, Germany. The address carries a risk score of 40 (Moderate Risk) and is associated with 2 DNSBL listings. No active threat indicators, known campaigns, or malicious reputation signals were detected. \--- \## Network Profile | Attribute | Value | |-----------|-------| | **IP Address** | 88.130.153.220/32 | | **Risk Score** | 40 (Moderate Risk) | | **ASN** | 8881 | | **Organization** | 1&1 Versatel GmbH | | **Network Block** | 88.130.0.0/16 | | **Geolocation** | Essen, North Rhine-Westphalia, Germany (DE) | | **Timezone** | Europe/Berlin | | **Service Status** | Firewalled / No Services | \--- \## Threat Indicators \- **Blacklist Count:** 2 DNSBL listings (of 8 total lists) \- **Known Attacker:** No \- **Tor Exit Node:** No \- **Spam Source:** No \- **Threat Feeds:** None detected \- **Known Campaigns:** None \- **Persistent Malicious Activity:** No \--- \## Network Behavior & Services \- **Open Ports:** None detected \- **HTTP/TLS Services:** No active services \- **DNS Resolution:** No PTR records; forward resolution unconfirmed \- **Email Authentication:** No SPF or DMARC records \- **Control Plane:** BGP prefix 88.130.144.0/20; route stability flag set to false \- **Operator Score:** 0.1304 (Minimal) \--- \## Subnet Neighborhood Analysis The /24 subnet (88.130.153.0/24) contains 2 sibling IPs with mixed risk profiles: | Neighbor IP | Risk Score | Authority Score | Classification | |-------------|------------|-----------------|----------------| | 88.130.153.77 | 55 | 50 | Medium Risk | | 88.130.153.185 | 25 | 50 | Low Risk | \- **Subnet Abuse Density:** 0 \- **Inherited Risk:** 0 \- **Active Threat Siblings:** 0 \--- \## Observation History 12 signal observations recorded, most recent from 2026-07-28. Key temporal indicators: \- **Ownership Changes:** 0 \- **Threat Persistence Days:** 0 \- **Threat Observation Count:** 0 \- **Signal Confidence Range:** 0.35–0.95 No persistent malicious activity detected. \--- \## Relationship Graph \- **Same Network:** DE-VERSATEL-20051018 (1 relationship) \--- \## Recommended Security Actions Based on risk profile, the following rules are recommended: **Firewall Rules:** \- iptables: \`iptables -A INPUT -s 88.130.153.220 -j DROP\` \- nftables: \`nft add rule inet filter input ip saddr 88.130.153.220 drop\` \- nginx: \`deny 88.130.153.220;\` \- pfSense: \`88.130.153.220/32\` **Cloud/WAF Rules:** \- Cloudflare WAF: Block IP with filter expression \`ip.src eq 88.130.153.220\` \- AWS WAF: Add rule for address \`88.130.153.220/32\` **Note:** These recommendations are probabilistic and should be validated against local threat intelligence and traffic patterns before deployment. \--- \## SOC Analyst Notes This IP demonstrates moderate risk primarily due to DNSBL listings rather than active malicious indicators. The absence of open services and threat indicators suggests the IP may be dormant, abandoned, or used for low-volume legitimate traffic. However, the presence of 2 DNSBL listings warrants monitoring. The adjacent subnet IP 88.130.153.77 (risk score 55) suggests potential correlation; consider blocking the entire /24 if traffic patterns justify it. No immediate threat to infrastructure; maintain monitoring and apply firewall rules as recommended. \--- *Intelligence generated by IPDebrief Platform* ## Nearby addresses - 88.130.153.77 (https://ipdebrief.com/88.130.153.77) - 88.130.153.117 (https://ipdebrief.com/88.130.153.117) - 88.130.153.185 (https://ipdebrief.com/88.130.153.185) - 88.130.153.186 (https://ipdebrief.com/88.130.153.186) - 88.130.153.231 (https://ipdebrief.com/88.130.153.231) - 88.130.153.251 (https://ipdebrief.com/88.130.153.251) --- Source: IPDebrief, "88.130.153.220 IP intelligence", https://ipdebrief.com/88.130.153.220, updated 2026-10-05. Assessments are probabilistic.