46.105.208.3📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 46.105.208.3/32

Date: 2026-06-19

Classification: MODERATE RISK HOSTING INFRASTRUCTURE

---

## EXECUTIVE SUMMARY

IP 46.105.208.3 is a moderate-risk (score: 40) cloud hosting address operated by OVH Srl (ASN 16276) within Italy. The endpoint hosts a single RDP service on port 3389 and shows minimal malicious indicators. While not flagged as a known attacker or spam source, the IP exhibits a 500km geolocation uncertainty radius and two DNSBL listings across eight total blacklist databases. The IP belongs to a mostly-clean subnet (46.105.208.0/24) with one inherited threat sibling.

---

## INFRASTRUCTURE PROFILE

---

## THREAT INDICATORS

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0 explicit
• DNSBL Listed: 2/8 total lists
• Campaign Association: None detected
• Threat Persistence: 0 days observed
• Operator Score: 0.2609 (Basic classification)

---

## OBSERVATION HISTORY

Total observations: 23 signals

Recent Activity:

• 2026-06-19: Operator score 0.2609 (Basic), signal confidence 0.60
• 2026-06-14: Geolocation signals confirmed Italy (43.9047, 7.7353), 500km accuracy; RDP service detected

Temporal Analysis:

• Ownership changes: 0
• Threat observation count: 1
• Persistence status: Not persistently malicious
• No correlated campaigns or banner matches identified

---

## NETWORK RELATIONSHIPS

Total Relationships: 53

Key Associations:

• Network: Multiple OVH-DEDICATED-FO relationships
• DNS: ip3.ip-46-105-208.eu
• Network Type: OVH DEDICATED-FO (cloud hosting)

No direct organization or certificate relationships detected beyond network-level associations.

---

## NEIGHBORHOOD ANALYSIS

Subnet: 46.105.208.0/24

Abuse Density: 1

Classification: mostly_clean

Inherited Risk: 2

Total Siblings: 1 (active: 1, threat: 1)

The subnet shows minimal contamination, though one threat sibling exists within the /24 boundary.

---

## RECOMMENDED ACTIONS

Risk Score: 40 (Moderate)

Recommended Status: Monitor or Block (context-dependent)

Firewall Rules Generated:

• iptables: `iptables -A INPUT -s 46.105.208.3 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 46.105.208.3 drop`
• nginx: `deny 46.105.208.3;`
• pfSense: `46.105.208.3/32`
• Cloudflare WAF: Block with expression `ip.src eq 46.105.208.3`
• AWS WAF: Address `46.105.208.3/32`

---

## INTELLIGENCE ASSESSMENT

THREAT LEVEL: LOW-MODERATE

The IP represents a legitimate hosting endpoint with elevated exposure due to open RDP access. The moderate risk score (40) derives primarily from DNSBL listings and route instability rather than active malicious indicators. The IP is not associated with known campaigns or persistent threat activity.

SOC RECOMMENDATION:

• Immediate: No urgent action required
• Monitoring: Track for RDP exploitation attempts
• Mitigation: Consider blocking if RDP access is not required; ensure RDP services are protected with MFA
• Investigation: Correlate with any inbound connection attempts from this IP

CONFIDENCE: Moderate – Based on 23 historical observations and current network classification data.

---

*Generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.