46.224.219.195📋 Copy

# IP Intelligence Briefing: 46.224.219.195/32

## Executive Summary

IP 46.224.219.195 is classified as High Risk (Risk Score: 80/100) and is hosted on Hetzner Online GmbH cloud infrastructure in Nuremberg, Germany. The IP is associated with 4 DNS blacklist listings and exhibits cloud hosting characteristics with SSH, HTTP, and HTTPS services exposed.

## Infrastructure Profile

## Network Services

• Port 80 (HTTP): Open, HTTPS-redirect enabled
• Port 443 (HTTPS): TLS 1.3 enabled, cipher: TLS_AES_128_GCM_SHA256
• Port 22 (SSH): Open, SSH-2.0-OpenSSH_8.4p1 Debian-5
• TLS Certificate: Traefik default certificate (self-signed/issuer-tier: Basic)
• DNS PTR: static.195.219.224.46.clients.your-server.de

## Threat Indicators

• DNS Blacklist Listings: 4 out of 8 total lists
• Risk Classification: High Risk (80/100)
• Known Attacker: No confirmed campaigns
• Tor Exit Node: No
• Abuse Confidence: Variable (not definitively established)

## Historical Analysis

Analysis of 19 signal observations (most recent: 2026-07-31) indicates:

• No persistent malicious behavior detected (threat persistence days: 0)
• Stable ownership classification with no recent changes
• Consistent cloud infrastructure classification across observations
• HTTP/HTTPS responses with 404 status codes observed

## Neighborhood Assessment

Subnet 46.224.219.195/24 shows:

• Abuse Density: 0 (clean)
• Threat Siblings: 0
• Classification: Clean
• Active Siblings: 0

## Relationship Graph

• DNS Associations: static.195.219.224.46.clients.your-server.de (multiple records)
• Network Association: CLOUD-NBG1 (repeated references)
• No correlated malicious entities beyond hostname/network associations

## Recommended Actions

Immediate (Critical Severity)

1. Increase logging verbosity and review recent activity from this IP

2. Block at perimeter using provided firewall rules

Firewall Implementation

## Intelligence Assessment

Despite high-risk classification, the IP operates within a clean neighborhood with no correlated threat siblings. The 4 DNS blacklist listings may indicate:

• Temporary abuse activity
• False positive listings
• Single-point compromise on cloud infrastructure

Priority: Medium-High (monitor and block, but verify against local threat intelligence before aggressive action)

Sources: IPDebrief intelligence platform, Hetzner routing registry, DNS blacklists, control plane analysis

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.