176.9.158.217📋 Copy

## IP Intelligence Briefing: 176.9.158.217/32

Executive Summary

IP 176.9.158.217 is a low-risk web server infrastructure address hosted by Hetzner Online GmbH in Falkenstein, Germany. The IP operates as a cloud computing service provider endpoint with no known malicious indicators. Risk score: 25/100.

---

Ownership and Infrastructure

• Provider: Hetzner Online GmbH (ASN 24940)
• Network Block: 176.9.158.192/27 (HETZNER-fsn1-dc7)
• Location: Falkenstein, Saxony, Germany (51.17°N, 10.45°E)
• Infrastructure Type: CloudCompute / Web Server
• Network Classification: Hosting infrastructure, not residential or mobile

Network Services

• Open Ports: 80/tcp (HTTP), 443/tcp (HTTPS)
• HTTP/2 Support: Enabled
• HSTS: Configured (max-age=31536000; includeSubDomains)
• TLS Certificate: Kubernetes Ingress Controller Fake Certificate (CN=ingress.local)
• Reverse DNS: static.217.158.9.176.clients.your-server.de
• Forward Resolution: Confirmed to your-server.de domain

Threat Assessment

• Risk Score: 25 (Low Risk)
• Known Campaigns: None identified
• Blacklist Status: 0 blacklists (profile shows 1 DNSBL listing across 8 total lists)
• Tor/Proxy: Not identified as Tor exit node, proxy, or VPN
• Abuse Confidence: Not flagged as known attacker or spam source

Observation History (21 Signals)

Recent observations (2026-06-21) indicate:

• Geolocation: Consistent DE attribution with 400km accuracy radius
• HTTP Status: 404 Not Found responses
• Operator Score: Basic (0.3478)
• No evidence of escalating threat behavior or persistent malicious activity

Network Relationships

• DNS Associations: Linked to static.217.158.9.176.clients.your-server.de (38 relationship entries)
• Network Context: Part of HETZNER-fsn1-dc7 network block
• Subnet Analysis: 176.9.158.0/24 shows low abuse density

Neighborhood Context (176.9.158.0/24)

• Abuse Density: 1 (low)
• Subnet Classification: Mostly clean
• Siblings: 1 active sibling IP, 1 threat sibling IP detected in broader subnet
• Risk Distribution: No high-risk neighbors in immediate vicinity

Recommended Actions

Based on low-risk profile and legitimate hosting infrastructure classification:

1. Monitor: Continue passive observation for any behavioral changes

2. Allow: Standard web traffic permitted (ports 80/443)

3. No Firewall Blocks: No immediate blocking recommended

4. Certificate Verification: Note self-signed Kubernetes certificate; may indicate internal infrastructure rather than public-facing web service

Intelligence Notes

The IP exhibits characteristics of legitimate cloud infrastructure hosting. The Kubernetes Ingress certificate suggests internal container orchestration rather than public web presence. The 404 status code across observations indicates the endpoint may not actively serve content at the time of scanning. No actionable threat indicators detected.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.