46.165.243.36
IP Intelligence Briefing: 46.165.243.36
Date: 2026-06-09
---
**1. Core Profile**
- Risk Score: 66 (Moderate Risk)
- Ownership: Leaseweb (AS28753) – Hosting provider.
- Geolocation: Germany (DE), coordinates 51.17°N, 10.45°E.
- Threat Indicators:
- Tor exit node detected.
- Listed in 1 DNSBL (DNS-Based Blackhole List).
- Network Role: Tor exit node, SSH (port 22), HTTPS (port 443).
- TLS Certificate:
- Issuer: `www.id3nupqj2.com`
- Subject: `www.awtqlzm6wl6pomxa.net`
- Self-signed certificate.
---
**2. Observation History (30 Days)**
- Consistent Low Risk: No significant changes in risk score or threat signals.
- Key Trends:
- Stable geolocation and DNSSEC validation.
- No spikes in malicious activity or network anomalies.
---
**3. Relationships**
- Linked Entities:
- Same network: Leaseweb (AS28753).
- No direct connections to known malicious organizations or campaigns.
---
**4. Neighborhood Analysis**
- Subnet: 46.165.243.36/24.
- Abuse Density: 0 (Clean subnet).
- Neighbors: No active or risky sibling IPs in the subnet.
---
**5. Threat Assessment**
- Tor Exit Node: High-risk due to potential for anonymity-based attacks.
- DNSBL Listing: Indicates possible abuse or spam activity.
- TLS/SSH Services: Self-signed certificate and open SSH may signal misconfiguration or malicious intent.
---
**6. Recommendations**
1. Monitor Traffic: Investigate outbound traffic for signs of data exfiltration or C2 communication.
2. Block Tor Exit Nodes: Consider restricting access to Tor networks if the IP is not authorized.
3. Validate Certificates: Verify the legitimacy of the self-signed TLS certificate.
4. Check SSH Logs: Audit SSH access for unauthorized login attempts.
Conclusion: While the IP shows no immediate malicious activity, its association with Tor and DNSBL listing warrants further scrutiny. SOC teams should prioritize monitoring traffic patterns and ensuring service configurations are secure.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | LEASEWEB-DE-MNT |
| ASN | AS28753 |
| Network Name | — |
| CIDR Block | — |
| RIR | RIPE |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 443 | https | tcp | — |
| 22 | ssh | tcp | |
| Closed Ports | 25, 80, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
| SSH Version | SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u7 |
🔐 TLS Certificate
CN=www.som7j7k7kpyqnn5hr.net was found on this IP. This may indicate a previously hosted website, a decommissioned service, or stale infrastructure.| SANs | None |
| Valid From | 2026-02-23T00:00:00+00:00 |
| Valid Until | 2026-06-25T00:00:00+00:00 (expired) |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_256_GCM_SHA384 |
| Signature Algorithm | sha256RSA |
| Validity Period | 122 days |
| Serial Number | 00C1CA494DAE89D690 |
| Thumbprint | 5A0AD8A0A7D1B5DE490DE68F47467131DE9A2373 |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 30% | 2 | 4 |
| routing | 13% | 1 | 1 |
| services | 30% | 2 | 3 |
| ownership | 24% | 2 | 3 |
| reputation | 26% | 1 | 3 |
| geolocation | 27% | 2 | 3 |
| Overall | 25% | 10 | 17 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-22 13:35:43 UTC |
| Last Seen | 2026-06-26 21:06:49 UTC |
| Profile Built | 2026-06-27 17:17:45 UTC |
| Data Freshness | Live |
| Signal Types | 22 |
| Total Observations | 51 |
Full dossier details are available via our API.