RDAPNetwork CONTA-48 (NET-66-94-96-0-1), country unknown; Contabo Inc..
- Org
- Contabo Inc.
- Range
- NET-66-94-96-0-1
- Network
- CONTA-48
Verdict
UNKNOWNLow confidence
Only an isolated detection, which is not enough to call it malicious. That does not prove it is safe: it may simply be new.
0Supporting signals
0Independent sources
0Recent observations
25 / 100Threat score
Why the engine decided this
Deterministic engine · activity none- No rule raised or lowered concern; the evidence is insufficient.
Key indicators
- IP address
- 66.94.120.125
- ASN
- AS40021
- Holder
- CONTABO-40021 - Contabo Inc.
- Network
- CONTA-48
- Prefix
- 66.94.120.0/21
- Open ports
- 3389
- Tor exit
- No
- First seen
- Not reported by any source
- Last seen
- 2026-06-08 (110 days before)
Relationship graph
Expand| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| RDAP | Network CONTA-48 (NET-66-94-96-0-1), country unknown; Contabo Inc.. | — | — | Context |
 RIPEstat | Announced in 66.94.120.0/21 by AS40021 (CONTABO-40021 - Contabo Inc.). | — | — | Context |
 Shodan | Open ports 3389. | — | — | Context |
 VirusTotal | Only 1/91 vendors (1.1%) flag it: an isolated detection, not corroboration. | 1/91 | 110 days old | Neutral |
Coverage · checked, no record: AlienVault OTX, AbuseIPDB, ThreatFox, URLhaus, Feodo Tracker, Emerging Threats, Tor exit list · failed: GreyNoise
Analyst summary
Consistent with engineUnknown: nothing links this indicator to malicious or benign activity.
Lookups failed for GreyNoise: no information either way. Nothing was found, which is a coverage gap rather than evidence of safety.
Evidence pointing the other way
- [VirusTotal] Only 1/91 vendors (1.1%) flag it: an isolated detection, not corroboration.
Attribution
The evidence does not establish who operates this indicator.
Written by rules from the engine's evidenceSuggested pivots
Threat context
Context onlyNo group is directly linked to this indicator by any source.
All evidence
12 sources queried · click a row for its raw fields · ages computed by the engine| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| RDAP | Network CONTA-48 (NET-66-94-96-0-1), country unknown; Contabo Inc.. | — | — | Context |
| RIPEstat | Announced in 66.94.120.0/21 by AS40021 (CONTABO-40021 - Contabo Inc.). | — | — | Context |
| Shodan | Open ports 3389. | — | — | Context |
| VirusTotal | Only 1/91 vendors (1.1%) flag it: an isolated detection, not corroboration. | 1/91 | 110 days old | Neutral |
 GreyNoise | Lookup failed: no information either way. | — | — | Failed |
 AlienVault OTX | No record. | — | — | No record |
 AbuseIPDB | No record. | — | 1413 days stale | No record |
 ThreatFox | No record. | — | — | No record |
| URLhaus | No record. | — | — | No record |
| Feodo Tracker | No record. | — | — | No record |
 Emerging Threats | No record. | — | — | No record |
 Tor exit list | No record. | — | — | No record |
Engine rules applied
- LOOKUPS_FAILEDOne or more lookups failed; their absence carries no information.
- VT_ISOLATED_DETECTIONOnly 1-2 VirusTotal vendors (under 3%) flag the indicator.
- NO_POSITIVE_EVIDENCENo source provides malicious or benign evidence; absence is not proof either way.
Analyst summary
Consistent with engineUnknown: nothing links this indicator to malicious or benign activity.
Lookups failed for GreyNoise: no information either way. Nothing was found, which is a coverage gap rather than evidence of safety.
Evidence pointing the other way
- [VirusTotal] Only 1/91 vendors (1.1%) flag it: an isolated detection, not corroboration.
Attribution
The evidence does not establish who operates this indicator.
Written by rules from the engine's evidenceSuggested pivots
Key indicators
- IP address
- 66.94.120.125
- ASN
- AS40021
- Holder
- CONTABO-40021 - Contabo Inc.
- Network
- CONTA-48
- Prefix
- 66.94.120.0/21
- Open ports
- 3389
- Tor exit
- No
- First seen
- Not reported by any source
- Last seen
- 2026-06-08 (110 days before)
By source
RDAPRIPEstatAnnounced in 66.94.120.0/21 by AS40021 (CONTABO-40021 - Contabo Inc.).
- ASN
- 40021
- Holder
- CONTABO-40021 - Contabo Inc.
- Prefix
- 66.94.120.0/21
ShodanOpen ports 3389.
- Tags
- self-signed
- Ports
- 3389
- Vulns
- 0
- Hostnames
- vmi902271.contaboserver.net
Relationship graph
Click a node for details · edges are observed relationships, not ownershipContext
Attribution
The evidence does not establish who operates this indicator.
Relationship ≠ ownership. Shared IPs, ASNs or platforms never imply the same operator.
Threat context
Context onlyNo group is directly linked to this indicator by any source.
Evidence timeline
- 2026-06-08VirusTotal: Only 1/91 vendors (1.1%) flag it: an isolated detection, not corroboration
- 2026-09-26Investigated
Run history
2 collections of this indicator- 2026-09-26UNKNOWN25Live lookupsOpen · newest
- 2026-09-26UNKNOWN25Live lookupsShown
Sources are checked again on every live run, so a source that has since dropped the indicator from its feed can change the verdict. Each run keeps the evidence exactly as it was collected.
Recommended next steps
- huntIdentify the internal host and process that contacted 66.94.120.125.
- enrichPassive DNS and certificate lookups for 66.94.120.125.
Pivot to other tools
Opens the indicator in the source's own site (new tab).