46.166.172.195📋 Copy

## IP Intelligence Briefing: 46.166.172.195/32

Classification: LOW RISK | Date of Analysis: Current | Status: No Active Threat Indicators

---

EXECUTIVE SUMMARY

IP address 46.166.172.195 is classified as low risk with a risk score of 0. No active threat indicators, blacklist entries, or malicious campaigns were identified. The IP is hosted by Cherry Servers NOC in Siauliai, Lithuania and operates as a standard single-service host with SSH access enabled.

---

OWNERSHIP & GEOLOCATION

• Organization: Cherry Servers NOC (ASN 16125)
• Network Block: 46.166.172.192/29 (net-207177-284086-239806)
• RIR: RIPE
• Location: Lithuania (LT), Siauliai region
• Coordinates: 55.94°N, 23.24°E
• Geolocation Confidence: Validated (geoPlausible: true, geoConsensus: true)

---

NETWORK CLASSIFICATION & SERVICES

• Classification: Single-Service Host
• Open Ports: 22/TCP (SSH)
• SSH Banner: SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u10
• DNS PTR: ip-46-166-172-195.010.ptr.cherryservers.net
• Forward Resolution: Confirmed (1 hostname)
• Email Authentication: SPF record present; DMARC not configured
• TLS Certificate: None observed

---

THREAT INDICATORS ANALYSIS

• Risk Score: 0/100
• Abuse Confidence: Not applicable
• Blacklist Status: Clean (0 lists)
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Association: None detected
• Threat Observation Count: 0
• Persistently Malicious: No

---

NEIGHBORHOOD ANALYSIS (46.166.172.195/24)

• Subnet Classification: Clean
• Abuse Density: 0%
• Total Siblings: 5 IPs (4 active)
• Sibling Risk Distribution:

- 46.166.172.194: Risk 0 (Authority 60)

- 46.166.172.196: Risk 25 (Authority 60)

- 46.166.172.197: Risk 25 (Authority 60)

- 46.166.172.198: Risk 0 (Authority 60)

The /24 subnet demonstrates minimal abuse activity with no high-risk neighbors.

---

OBSERVATION HISTORY

• Total Observations: 19 signals recorded
• Recent Activity: July 30, 2026 (most recent)
• Ownership Changes: 0 (stable)
• Threat Persistence: 0 days
• Average RTT: 127.4ms (minimum possible: 22.9ms)
• Distance from Claimed Location: 1,145km (consistent with Lithuania geolocation)

Historical data indicates stable ownership with no escalation in threat posture.

---

RELATIONSHIP MAPPING

• DNS Associations: cherryservers.net domain (3 duplicate entries)
• Network Associations: net-207177-284086-239806 (3 duplicate entries)
• No external entity relationships detected

---

RECOMMENDED ACTIONS

Based on current risk profile, no immediate blocking or firewall rules are recommended. The IP presents no security threats. Standard monitoring practices applicable.

Monitoring Priority: LOW

---

ANALYST NOTES

This IP address represents a legitimate hosting environment with no malicious indicators. The classification as "Tor Exit Nodes" appears to be a network role flag rather than actual Tor exit node functionality, given the absence of corresponding indicators. The SSH service is configured with a modern OpenSSH version. Recommend continued passive monitoring without active blocking measures.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.