46.225.11.104📋 Copy

# IP Intelligence Briefing: 46.225.11.104/32

## Executive Summary

IP address 46.225.11.104 is a German cloud compute endpoint operated by Hetzner Online GmbH with a moderate risk score of 40. The IP shows no active threat indicators but is assigned a moderate operator score (0.5217). The address resolves to a Hetzner cloud infrastructure subnet with firewalled services.

## Ownership and Infrastructure

## Geolocation

• Country: Germany (DE)
• Region: Bavaria
• City: Nuremberg
• Coordinates: 51.17°N, 10.45°E
• Geo Consensus: Yes (2 sources)

## Network Classification

• Is Cloud: Yes
• Is CDN: No
• Is Proxy/VPN/Tor: No
• Is Residential: No
• Open Ports: None detected
• Service Purpose: Firewalled / No Services

## Threat Indicators

• Blacklist Count: 0
• DNSBL Listed: 2 of 8 lists
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Known Campaigns: None

## Observation History

25 signals observed across recent monitoring periods. Geo-location signals consistently indicate Germany. Operator score remains stable at 0.5217 (Moderate). No threat persistence detected.

## Neighborhood Analysis

Subnet: 46.225.11.0/24

• Abuse Density: 0% (clean)
• Total Siblings: 2
• Threat Siblings: 0
• Neighbor IP 46.225.11.19: Risk score 40, Authority score 60

## DNS Resolution

• PTR Hostname: static.104.11.225.46.clients.your-server.de
• Forward Confirmed: Yes
• Hosted Domain: your-server.de

## Recommended Actions

While no active threat indicators are present, the moderate risk score warrants monitoring. Recommended controls include:

Firewall Rules:

```

# iptables

iptables -A INPUT -s 46.225.11.104 -j DROP

# nftables

nft add rule inet filter input ip saddr 46.225.11.104 drop

```

Cloud/WAF Configuration:

• Block traffic from this IP if legitimate access patterns are not expected
• Monitor for anomalous outbound connections from this endpoint

## Intelligence Assessment

This IP resides in Hetzner's German cloud infrastructure. The moderate risk score likely reflects the infrastructure provider's classification rather than active malicious activity. No correlation with known threat campaigns or attacker infrastructure. The subnet shows clean abuse density with no threat-sibling IPs.

Recommendation: Monitor for activity anomalies but no immediate blocking required unless specific threat intelligence correlates with this address.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.