46.225.233.87📋 Copy

# IP Intelligence Briefing: 46.225.233.87/32

Classification: Moderate Risk (Score: 40)

Reporting Date: Current analysis based on available signal data

## 1. Ownership and Infrastructure

The IP address 46.225.233.87 is allocated to Hetzner Online GmbH (ASN 24940), a German cloud hosting provider. The address resides within the 46.224.0.0/15 BGP prefix, originating through AS6939 and AS24940. The network classification identifies this as a cloud compute infrastructure host with single-service purpose.

Geolocation Discrepancy: Primary geolocation data indicates Nuremberg, Bavaria, Germany. However, historical signal observations from 2026-06-15 recorded an alternative geolocation attribution to Iran (IR) via alienvault-otx with a reputation score of 0 and 13 associated threat pulses.

DNS Resolution: The IP resolves to `static.87.233.225.46.clients.your-server.de` under the domain `your-server.de`. Forward DNS resolution is confirmed.

## 2. Network Services

Active service enumeration reveals SSH on port 22/TCP with banner: `SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.16`. No HTTP services or TLS certificates are currently observed. The infrastructure hosts single-service configurations typical of cloud compute environments.

## 3. Threat Indicators

• Risk Score: 40/100 (Moderate Risk)
• DNSBL Listings: Listed on 2 of 8 total DNS blacklists
• Threat Signals: One threat observation recorded on 2026-06-15
• Tor/Proxy/VPN: Not classified as Tor exit node, proxy, or VPN
• Known Campaigns: No active campaign associations identified
• ISP Reputation: Operator score 0.4783 (Basic classification)

## 4. Observation History

Signal observation history contains 24 recorded events. Notable temporal patterns include:

• 2026-06-15T07:15:39: IR geolocation attribution with 13 threat pulse associations
• 2026-06-15T07:18:26: Subnet classification recorded as "mostly_clean" with abuse density 1
• 2026-06-15T07:17:08: Operator score calculation showing basic classification (0.55 raw score)

The IP is not flagged as persistently malicious. Threat observation count is 1 with 0 days of threat persistence.

## 5. Neighborhood Analysis

The /24 subnet (46.225.233.0/24) shows mixed neighborhood data:

• Profile neighborhood data indicates 1 total sibling, 1 active sibling, and 1 threat sibling
• Abuse density classified as "mostly_clean" with inherited risk score of 2
• Network classification: `CLOUD-NBG1` (Hetzner datacenter network)

## 6. Related Entities

Multiple relationship entities link to the following:

• Hostname: `static.87.233.225.46.clients.your-server.de` (repeated DNS association)
• Network: `CLOUD-NBG1` (multiple same-network relationships)

## 7. Recommended Security Actions

Based on risk assessment, the following firewall rules are recommended:

iptables:

```

iptables -A INPUT -s 46.225.233.87 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 46.225.233.87 drop

```

Cloudflare WAF:

```json

{

"description": "Block 46.225.233.87 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 46.225.233.87"

}

}

```

AWS WAF:

```json

{

"Addresses": ["46.225.233.87/32"],

"Description": "IPDebrief risk 40"

}

```

## 8. Analyst Assessment

This IP address presents a moderate risk profile with conflicting geolocation signals. The primary Hetzner infrastructure attribution suggests legitimate cloud hosting, but historical IR geolocation signals and DNSBL listings indicate potential abuse or misconfiguration. The SSH service is standard for cloud infrastructure.

Key Indicators for Further Investigation:

1. Correlate the IR geolocation signal with actual traffic patterns

2. Review DNSBL listing reasons and associated reputation feeds

3. Monitor for connection attempts from this subnet to internal resources

4. Assess whether the single threat observation correlates with observed network activity

Risk Rating: MODERATE — Block recommended pending correlation with internal threat intelligence.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.