45.86.202.76📋 Copy

# IP Intelligence Briefing: 45.86.202.76/32

Classification: LOW RISK

Date: 2026-07-27

Prepared For: SOC Analyst Team

## Executive Summary

IP address 45.86.202.76 is classified as Low Risk with a risk score of 25. The address is associated with VPN Consumer infrastructure in Frankfurt, Germany (ASN 206092). No active threat indicators were detected, and the IP shows no evidence of malicious behavior. The subnet exhibits mixed classification with moderate abuse density, warranting contextual monitoring.

## Technical Profile

## Threat Assessment

Active Indicators: None

• Not a Tor exit node
• Not flagged as known attacker
• Not identified as spam source
• No active threat campaigns detected
• No malicious DNSBL entries

Control Plane Analysis:

• Route stability: Stable (0 route changes in 30 days)
• Operator score: 0.1304 (Minimal)
• DNSSEC: Valid
• BGP prefix: 45.86.202.0/24

## Neighborhood Context (45.86.202.0/24)

Risk Distribution in Subnet:

• High Risk: 0
• Medium Risk: 1
• Low Risk: 67

## Observation History

16 observations recorded since last monitoring cycle. Key findings:

• Geolocation: Consistent Frankfurt, Germany location (296.5km distance validation)
• RTT Metrics: Average 104ms, minimum 5.9ms (plausible)
• Ownership: Stable (0 ownership changes)
• Persistence: Not persistently malicious
• Threat Persistence: 0 days

## Recommended Actions

Current Status: No immediate firewall rules recommended. Risk score of 25 indicates low threat profile.

Monitoring Recommendations:

1. Monitor subnet-level activity due to 17 threat siblings in 45.86.202.0/24

2. Continue observing for changes in service status (currently firewalled)

3. Review if inbound connections originate from this IP address

4. Consider block if observed in malicious context despite low inherent risk

## Intelligence Narrative

The IP 45.86.202.76 presents as a legitimate, low-risk address associated with commercial VPN infrastructure in Frankfurt, Germany. The absence of open ports and services, combined with zero blacklist entries and no active threat indicators, supports classification as benign infrastructure. However, the subnet's mixed classification with 17 identified threat siblings suggests this IP range may host multiple use cases, including potentially malicious endpoints. SOC teams should monitor for any behavioral changes or service activation on this address while maintaining contextual awareness of the broader subnet's reputation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.