94.72.127.251📋 Copy

# IP Intelligence Briefing: 94.72.127.251/32

## Executive Summary

IP address 94.72.127.251/32 presents a low-risk profile (score: 25) with mixed operational indicators. The IP is registered to Contabo (ASN 40021) and operates as a cloud compute host in the German network 94.72.120.0/21. However, geolocation inconsistencies and DNSBL listings warrant continued monitoring. The subnet classification is "mostly_clean" with low abuse density.

## Network Classification

## Geolocation Analysis

Current Consensus: Germany (DE), Swidnik, Region 06

Coordinates: 51.17°N, 10.45°E

Timezone: Europe/Berlin

Anomaly Detected: Geolocation validation failed with RTT violation. Minimum observed RTT (79.0ms) is below the theoretical minimum (158.2ms) for the stated distance (7,910km), indicating potential geolocation spoofing or routing irregularities.

## Observations and History

The IP has generated 22 signal observations. Key temporal patterns:

June 28, 2026:

• ASN reported: AS41314 eco trade sp. z o. o
• Location: Swidnik, Poland
• Reputation: 0, has threats flag active
• Pulse count: 4 threat indicators

June 20, 2026:

• ASN reported: AS40021 (Contabo Inc.)
• Location: Seattle, United States
• Proxy type: VPN detected
• Risk score: 66 (proxycheck-io)

Geographic Inconsistency: The IP has been observed across Germany, Poland, and United States within a 7-day window, indicating either aggressive spoofing or legitimate multi-region cloud operations.

## DNS and Service Analysis

Service Fingerprint: Standard cloud server with SSH access. No web services, TLS certificates, or HTTP headers detected.

## Threat Indicators

• DNSBL Listed: 1 of 8 threat lists
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Campaign Correlation: No matches
• Threat Persistence: 0 days

## Network Neighborhood

No significant neighboring IPs detected within the /24 subnet.

## Relationship Graph

37 relationships identified:

• DNS Associations: vmi3195040.contaboserver.net
• Network Associations: TT-20240214 (multiple instances)
• Certificate Associations: None

## Recommended Actions

## Intelligence Assessment

This IP address represents a standard Contabo cloud hosting environment with one DNSBL listing. The primary concern is the geographic inconsistency observed between June 20-28, 2026, which could indicate either:

1. Legitimate multi-region cloud operations

2. Aggressive IP reputation manipulation

3. Routing anomalies unrelated to abuse

The low abuse density in the surrounding subnet and lack of active threat siblings suggest minimal immediate threat. However, the RTT/geolocation violation and transient threat signals warrant periodic re-evaluation.

Confidence Level: Medium

Recommended Action: Monitor

---

*Report generated: 2026-06-28 | Data sources: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.