46.166.172.196📋 Copy

# Threat Intelligence Briefing: 46.166.172.196/32

Classification: Low Risk

Date: 2026-07-30

Analyst: IPDebrief Intelligence

---

## Executive Summary

IP address 46.166.172.196 presents a low-risk threat profile (risk score: 25). The address is owned by Cherry Servers NOC (ASN 16125), a legitimate hosting provider with infrastructure registered in Lithuania. No active malicious campaigns, threat indicators, or persistent abuse patterns detected. Neighborhood analysis indicates a clean subnet environment with zero threat siblings.

---

## Ownership and Registration

Geolocation Validation: Confirmed. Claimed coordinates (55.94, 23.24) are plausible with geolocation consensus. Minimum RTT: 1145 km distance from probe origin.

---

## Network Services

• Open Ports: 22/SSH only
• SSH Banner: SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u10
• DNS PTR: ip-46-166-172-196.001.ptr.cherryservers.net
• Forward Resolution: Confirmed (1 hostname)
• Email Authentication: SPF enabled, DMARC not configured
• TLS Certificate: None observed
• HTTP Service: None observed

Service Classification: Single-Service Host

---

## Threat Indicators

Campaign Assessment: No correlated IPs, no certificate matches, no banner matches indicating active campaigns.

---

## Neighborhood Analysis

Subnet: 46.166.172.196/24

• Abuse Density: 0% (clean)
• Total Siblings: 5
• Threat Siblings: 0

Neighborhood Classification: Clean. No inherited risk from adjacent addresses.

---

## Control Plane Status

• Origin ASN: 16125
• BGP Prefix: 46.166.168.0/21
• Route Stability: Unstable (false)
• Route Changes (30d): 0
• DNSSEC Valid: true
• IRR Consistency: Not available
• Operator Score: 0.2609 (Basic)

---

## Observation History (18 Signals)

Recent activity observed from 2026-07-30:

• Geolocation signals: Consistent Lithuania placement
• DNS resolution: Forward confirmed
• Network scanning: SSH service detected
• Ownership data: Stable (0 ownership changes)
• Threat signals: None observed
• Persistence: Not persistently malicious

---

## Security Actions

Recommendation: No specific blocking or firewall rules required. The IP maintains a low-risk profile with no active threat indicators.

Permitted Traffic: SSH (port 22) from the address appears to be legitimately hosted service traffic from Cherry Servers infrastructure.

---

## SOC Analyst Notes

• No immediate threat action required.
• Monitor for any changes in DNSBL listings or new threat indicators.
• Neighborhood analysis supports continued traffic allowance.
• Route stability concerns noted but not associated with active abuse.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.