95.217.80.148📋 Copy

IP Intelligence Briefing: 95.217.80.148

Date: June 9, 2026

---

**1. Core Profile**

• Risk Assessment:

- Overall Risk: Low (Risk Score: 30)

- Provider Score: 0 (Hetzner Online GmbH)

- Threat Indicators: No malicious activity detected (no malware, phishing, or exploit campaigns).

- Geolocation:

- Country: Germany (DE)

- City: Helsinki (Finland)

- Region: Uusimaa (Finland)

- Latitude/Longitude: 51.17°N, 10.45°E

- Network Role: CloudCompute infrastructure (Hetzner Hosting).

---

**2. Threat & Vulnerability Context**

• Malicious Activity:

- No indicators of compromise (IOC) detected.

- No DNS-based attacks, spam, or Tor exit node associations.

• TLS Certificate:

- Valid Let’s Encrypt certificate for `k2plesk3.qsoftweb.com` (issued to YR1).

- No self-signed or expired certificates.

• Open Ports:

- HTTP (80), HTTPS (443), SSH (22), HTTPS-alt (8443).

- No suspicious banners or unexpected services.

---

**3. Network & Subnet Analysis**

• Subnet: 95.217.80.148/24

- Abuse Density: 1 (mostly clean).

- Neighboring IPs: No active siblings or threats in the subnet.

• Provider:

- ASN: AS24940 (Hetzner Online GmbH).

- Infrastructure: Cloud hosting, no residential/VPN/CDN associations.

---

**4. Historical Observations (Last 30 Days)**

• Stability:

- Route stability: False (potential ISP changes).

- Threat persistence: 0 days (no long-term malicious behavior).

• Key Changes:

- Proxy association detected (VPN type) with 85% confidence.

- Subnet classification remained "mostly clean."

---

**5. Relationships & DNS**

• DNS Associations:

- Hostname: `k2plesk3.qsoftweb.com` (Q-SOFT domain).

- No email authentication (SPF/DKIM/DMArC) detected.

• Network Relationships:

- Linked to Q-SOFT network (same subnet).

---

**6. SOC Actionable Insights**

• Monitor:

- Track DNS and TLS changes for `k2plesk3.qsoftweb.com`.

- Verify geolocation discrepancies (Germany vs. Finland).

• Mitigate:

- Block VPN/Proxy traffic if unauthorized access is suspected.

- Ensure TLS configurations are up-to-date (e.g., HSTS, HTTP/2).

• Investigate:

- Validate the proxy association (VPN) and its legitimacy.

---

Conclusion: The IP is a low-risk cloud-hosted server with no immediate threats. Focus on verifying geolocation anomalies and monitoring for unexpected changes in network behavior. No urgent remediation required.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.