78.46.191.135📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 78.46.191.135/32

Date: Current Assessment

Risk Level: Moderate (Score: 50/100)

---

## Executive Summary

IP address 78.46.191.135 is associated with Hetzner Online GmbH (ASN 24940), a cloud hosting provider located in Nuremberg, Germany. The address exhibits moderate risk characteristics with historical DNS blacklist activity and operational associations with a compromised subnet. No active open services are detected, and the IP is currently classified as a cloud compute resource with hosting infrastructure designation.

---

## Technical Profile

Ownership & Registration:

• ASN: 24940 (Hetzner Online GmbH)
• Organization: Hetzner Online GmbH - Contact Role
• RIR: RIPE
• CIDR Block: 78.46.0.0/15

Geolocation:

• Country: Germany (DE)
• Region: Bavaria
• City: Nuremberg
• Coordinates: 51.17°N, 10.45°E
• Accuracy: 400 km radius

Network Classification:

• Infrastructure Type: Cloud Compute
• Is Hosting: Yes
• Is CDN/VPN/Proxy: No
• Open Ports: None detected (Firewalled / No Services)

DNS Resolution:

• PTR Hostname: static.135.191.46.78.clients.your-server.de
• Domain: your-server.de
• Forward Resolution: Confirmed
• Email Auth: SPF and DMARC configured

---

## Threat Assessment

Current Threat Indicators:

• No active threat feeds or known campaigns
• No known attacker attribution
• No Tor exit node activity
• Abuse Confidence Score: Not calculated

Historical Threat Activity:

• 18 observations recorded over monitoring period
• DNSBL listings detected: 8 total lists
• Maximum severity: High (observed 2026-06-20)
• Listed count: 1 active listing at peak observation
• Operator Score: 0.3478 (Basic)

Control Plane Data:

• Route Stability: False
• Route Changes (30d): 0
• DNSSEC: Valid
• RPKI State: Not evaluated

---

## Neighborhood Analysis

Subnet: 78.46.191.135/24

• Abuse Density: 1
• Classification: Mostly Clean
• Inherited Risk: 2
• Total Siblings: 1
• Active Siblings: 0
• Threat Siblings: 1

The /24 subnet shows minimal abuse activity but contains one threat-associated sibling IP.

---

## Related Entities

DNS Associations:

• static.135.191.46.78.clients.your-server.de (repeated associations)

Network Associations:

• CLOUD-NBG1 (same network)

Total Relationships: 43 detected associations

---

## Recommended Actions

Based on risk profile and historical activity, the following mitigations are recommended:

Firewall Blocking:

• iptables: `iptables -A INPUT -s 78.46.191.135 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 78.46.191.135 drop`
• pfSense: `78.46.191.135/32`

WAF Integration:

• Cloudflare WAF: Block IP with expression `ip.src eq 78.46.191.135`
• AWS WAF: Address `78.46.191.135/32`

Monitoring:

• Continue monitoring for service changes
• Track DNSBL listing updates
• Correlate with subnet 78.46.191.0/24 activity

---

Analysis Notes: While no active services are currently accessible, the historical DNS blacklist activity and hosting infrastructure designation warrant continued monitoring. The IP may serve as a backend or staging address for hosted services. Recommended action is conservative blocking pending further correlation with threat intelligence feeds.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.