46.166.172.197📋 Copy

IP INTELLIGENCE BRIEFING: 46.166.172.197/32

Classification: Low Risk | Risk Score: 25 | Last Updated: 2026-07-30

---

**Ownership and Infrastructure**

The target IP 46.166.172.197 is assigned to ASN 16125 (Cherry Servers NOC) under RIPE registration. The IP resides in the 46.166.172.192/29 block, located in Siauliai, Lithuania. The organization maintains abuse contact channels via RDAP. The IP resolves to the PTR hostname ip-46-166-172-197.002.ptr.cherryservers.net with forward confirmation enabled.

---

**Network Classification**

The IP is classified with a provider role associated with Tor Exit Nodes. Network scanning indicates SSH service (port 22) running OpenSSH 9.2p1 Debian-2+deb12u10. The network role is identified as a Single-Service Host. Email authentication shows SPF records present but DMARC absent.

---

**Threat Assessment**

Current threat indicators show zero malicious activity. The IP maintains:

• No blacklist entries (0/0)
• No known attacker or spam source designation
• No correlation to active campaigns
• Zero threat observation count with no persistent malicious behavior

---

**Observation History**

Signal observation history contains 19 records from 2026-07-30. Observations confirm consistent ownership with no changes recorded. Threat persistence remains at zero days. The IP is not flagged as persistently malicious. Ownership stability is maintained with zero recorded ownership changes.

---

**Network Neighborhood Analysis**

The /24 subnet 46.166.172.197/24 exhibits clean classification with an abuse density score of 0. The subnet contains 5 total siblings with zero active or threat-classified siblings. Neighboring IPs include:

• 46.166.172.194 (Risk: 0)
• 46.166.172.195 (Risk: 0)
• 46.166.172.196 (Risk: 25)
• 46.166.172.198 (Risk: 0)

---

**Relationship Graph**

Six relationships identified:

• Four DNS associations to cherryservers.net hostnames
• Two same-network associations to net-207177-284086-239806

---

**Security Recommendations**

No specific firewall or mitigation actions recommended at this time based on current risk profile. The IP demonstrates benign characteristics consistent with legitimate infrastructure hosting.

---

**Analyst Notes**

While network classification indicates Tor Exit Node association, current threat signals show no malicious activity. The subnet maintains clean status with no abuse density. SOC teams should maintain standard monitoring protocols. The absence of blacklist entries and zero threat observation count supports continued passive monitoring rather than immediate blocking.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.