46.224.175.215📋 Copy

# IP Intelligence Briefing: 46.224.175.215/32

## Executive Summary

IP address 46.224.175.215 was identified as a moderate-risk (score: 40) cloud computing endpoint operated by Hetzner Online GmbH in Falkenstein, Germany. The IP resolves to your-server.de and hosts web services on ports 80/443 with SSH access on port 22. Network analysis indicates a low-abuse-density subnet (46.224.175.0/24) with minimal correlated threat activity.

## Technical Profile

## Threat Indicators

• Risk Score: 40 (Moderate Risk)
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Blacklist Count: 0
• DNSBL Listings: 2 of 8 total lists

The IP does not match any known attack campaigns or threat feeds. However, the moderate risk score warrants monitoring due to the hosting infrastructure classification.

## Neighborhood Analysis

Subnet 46.224.175.0/24 exhibits low abuse density (score: 0) with classification "mostly_clean." One neighbor IP (46.224.175.79) showed moderate risk (score: 25). The subnet inherited risk score of 5, indicating limited correlation with known malicious activity at the network level.

## Historical Observations

25 observations captured over the analysis period. Recent signals confirm consistent cloud infrastructure classification with Hetzner provider attribution. HTTP fingerprinting revealed HTTP/2.0 support with 358ms TTFT and missing security headers (CSP, HSTS, X-Frame-Options). Email authentication (SPF/DMARC) status was not validated for the associated domain.

## Recommended Security Actions

Based on the risk profile, the following defensive measures are recommended:

Immediate Blocking Rules:

```bash

# iptables

iptables -A INPUT -s 46.224.175.215 -j DROP

# nftables

nft add rule inet filter input ip saddr 46.224.175.215 drop

# nginx

deny 46.224.175.215;

# pfSense

46.224.175.215/32

# Cloudflare WAF

Block 46.224.175.215 — IPDebrief risk score 40

# AWS WAF

Addresses: 46.224.175.215/32

```

Analysis Notes:

• SSH access (port 22) from a hosting provider IP may indicate potential lateral movement attempts
• Open HTTP/HTTPS ports align with expected web hosting services
• No evidence of active exploitation campaigns or known bad actor attribution
• Recommendation to monitor for changes in risk classification over the next 7-14 days

## Conclusion

The IP represents a moderate-risk cloud endpoint with no definitive malicious indicators. Blocking is recommended as a precautionary measure consistent with Hetzner's hosting infrastructure profile. Continued monitoring advised to track any changes in reputation or threat indicators.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.