178.104.254.183📋 Copy

# IP Intelligence Briefing: 178.104.254.183

## Executive Summary

IP address 178.104.254.183 is a low-risk residential/hosting IP registered to Hetzner Online GmbH, operating from Nuremberg, Bavaria, Germany. The IP demonstrates stable infrastructure characteristics with minimal threat indicators, though moderate operator-level risk factors warrant routine monitoring.

## Infrastructure Profile

## Technical Fingerprint

• Server Software: nginx/1.18.0 (Ubuntu)
• TLS Certificate: CN=app.mps.rs (Let's Encrypt R12)
• HTTP Behavior: Returns 302 redirect
• Open Ports: 80/TCP, 443/TCP, 22/TCP (SSH)
• SSH Banner: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.15
• DNS Records:

- PTR: static.183.254.104.178.clients.your-server.de

- Forward Resolution: Confirmed

- SPF: Present

- DMARC: Present

## Threat Indicators

## Control Plane Analysis

• BGP Prefix: 178.104.0.0/15
• AS Path: 3303 → 24940
• Route Stability: Stable (0 changes in 30 days)
• MOAS Status: Not a Monocast Origin AS
• Operator Score: 0.7391 (Moderate)
• Geolocation Validation: Plausible (distance: 456.6 km from probe origin)
• Minimum Possible RTT: 9.13 ms
• Average RTT: 108 ms

## Neighborhood Assessment

• Subnet: 178.104.254.183/24
• Abuse Density: 1 (Low)
• Classification: Mostly Clean
• Total Siblings: 1
• Active Siblings: 1
• Threat Siblings: 1

## Observation History (30 signals)

Recent observations indicate:

• HTTP service fingerprinting (nginx/1.18.0) with 302 redirects
• HTTPS implementation with Let's Encrypt certificates
• Geo-location signals consistent with German infrastructure
• Historical Alienvault OTX signal (GB location, 2 pulses) appears anomalous vs. German registration
• Control plane operator scoring at moderate levels

## Relationships

• DNS Associations: static.183.254.104.178.clients.your-server.de (multiple records)
• Network Associations: CLOUD-NBG1
• Total Relationships: 41

## Recommended Actions

Based on the low-risk profile and minimal threat indicators, the following actions are recommended:

1. Allow: Standard web traffic (ports 80, 443) with rate limiting

2. Monitor: SSH access (port 22) if inbound traffic observed

3. Block: No immediate blocking required

4. Monitor List: Add to watchlist for operator-level scoring changes

## Intelligence Narrative

The IP address 178.104.254.183 operates as a legitimate cloud hosting service under Hetzner's infrastructure. The moderate operator score (0.7391) and single DNSBL listing suggest the IP may have been involved in minor abuse activities historically, though current indicators show no active malicious behavior. The infrastructure demonstrates stability with consistent routing and valid DNSSEC. The historical anomaly (UK geolocation signal vs. German registration) appears to be a geolocation discrepancy rather than evidence of malicious activity.

Classification: LOW RISK — Continue routine monitoring

Priority: Standard

Action: Allow with standard web filtering policies

---

*Data Source: IPDebrief Intelligence Platform*

*Analysis Date: Based on latest available signal observations*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.