95.111.251.78📋 Copy

## IP Intelligence Briefing: 95.111.251.78/32

Executive Summary

IP 95.111.251.78 is a cloud-hosted endpoint assigned to Contabo infrastructure. The IP exhibits geolocation inconsistencies (France vs Germany) and has been classified as a proxy/VPN service in historical observations. Current profile shows no open services, indicating firewall hardening or non-public-facing deployment.

Technical Profile

Infrastructure Classification:

• Provider: Contabo (CloudCompute infrastructure)
• ASN: AS51167
• BGP Prefix: 95.111.250.0/23
• Network Role: Firewalled / No Services

Geolocation Data:

• Reported Location: Lauterbourg, Grand Est, France (48.97°N, 8.19°E)
• Alternative Geo: Munich, Germany (historical observation)
• GeoConsensus: Confirmed (single source)
• Note: Geolocation discrepancies observed between probes

DNS Resolution:

• PTR Hostname: vmi3020399.contaboserver.net
• Forward Resolution: vmi3020399.contaboserver.net (confirmed)
• Hosted Domains: None
• Email Authentication: SPF/DMARC not configured

Threat Indicators

Current Risk Assessment:

• Reputation Score: Low Risk
• Risk Score: 0
• Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No

Historical Observations (15 total):

• Proxy/VPN classification observed (risk score: 66)
• Provider confirmed: Contabo GmbH
• Abuse contact: abuse@contabo.de
• Geolocation variance between FR/DE registries

Network Behavior

• Services: No open ports detected (firewalled)
• HTTP/TLS: No active web services
• Network Stability: Route changes observed (not stable)
• Campaign Correlation: No known campaign matches
• Certificate Matches: None

Relationship Graph

• DNS Associations: 2 entries → vmi3020399.contaboserver.net
• Subnet Analysis: 95.111.251.0/24
• Neighbor Activity: 0 siblings discovered
• Abuse Density: 0% subnet-wide

SOC Recommendations

1. Monitor for Proxy/VPN Activity: Historical data indicates proxy classification with 66 risk score. Monitor outbound connections from this IP.

2. Geolocation Validation: Verify actual deployment location given FR/DE discrepancies. Consider additional geolocation probes.

3. Email Authentication: No SPF/DMARC configured for associated hostname. Validate email traffic if this IP handles email.

4. Infrastructure Context: Contabo cloud hosting provider commonly used for VPS services. Treat as potential low-risk endpoint unless threat indicators escalate.

5. Firewall Rules: Current profile shows no open services. Default allow policy may be appropriate pending threat indicator correlation.

Classification: LOW RISK — Cloud-hosted endpoint with historical proxy classification. No active threat indicators. Monitor for behavior changes.

Last Updated: 2026-08-06

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.