178.104.40.197📋 Copy

## IP Intelligence Briefing: 178.104.40.197/32

Classification: Moderate Risk (Score: 50/100) | Provider: Hetzner Online GmbH (ASN 24940) | Network: 178.104.0.0/15

---

Executive Summary

IP 178.104.40.197 is a Hetzner cloud compute endpoint with a moderate risk profile. The IP is classified as a single-service host with SSH services exposed. While the IP itself shows no direct threat indicators, it is listed on 2 of 8 DNSBLs, suggesting potential misuse by this address or related infrastructure.

---

Profile Summary

---

Threat Indicators

• Abuse Confidence Score: Not available
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0 (but 2 DNSBL listings per control plane)
• Known Campaigns: None identified

---

Historical Observation

The IP has been observed 23 times in the signal history. Recent observations show:

• Control plane operator score of 0.4
• DNSSEC validation present
• CAA records configured
• SSH service banner detected: SSH-2.0-OpenSSH_10.0p2 Debian-7

No persistent malicious activity detected; threat persistence days: 0.

---

Network Context

• Subnet Classification: Clean (abuse density: 0)
• Neighbor Count: 0 active threats in /24
• Route Stability: Stable (0 route changes in last 30 days)
• GeoValidation: GeoPlausible flag set, though geolocation consensus varies

---

Recommended Actions

Based on the moderate risk profile, the following firewall rules are recommended for defensive security:

iptables:

```bash

iptables -A INPUT -s 178.104.40.197 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 178.104.40.197 drop

```

nginx:

```nginx

deny 178.104.40.197;

```

Cloudflare WAF:

```json

{"description":"Block 178.104.40.197 — IPDebrief risk score 50","action":"block","filter":{"expression":"ip.src eq 178.104.40.197"}}

```

AWS WAF:

```json

{"Addresses":["178.104.40.197/32"],"Description":"IPDebrief risk 50"}

```

---

Intelligence Assessment

This IP represents a Hetzner cloud endpoint with moderate risk characteristics. The presence of DNSBL listings without direct threat indicators suggests either legitimate use flagged by overly restrictive lists or potential abuse that has not yet been confirmed. No known campaigns correlate with this address.

Recommendation: Monitor for additional threat signals. If traffic from this IP is observed in production environments, apply the recommended blocking rules while maintaining awareness that Hetzner is a major legitimate hosting provider. Further investigation should focus on the source of the DNSBL listings.

---

*Report generated: IPDebrief Intelligence Platform | Data sources: Real-time observation and historical analysis*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.