Autonomous system
AS24940 HETZNER-AS
Hosting RIPE Content
Summary
Hetzner Online GmbH
hosting dedicated cloud
Hetzner is a German hosting provider popular for inexpensive dedicated servers, cloud instances, and colocation, with data centers in Germany, Finland, and the United States.
What it's used for
- Budget-friendly dedicated and cloud servers used by developers, self-hosters, and small businesses.
- General-purpose hosting — websites, game servers, build runners, VPNs, and hobby projects.
Notable
- Because it is cheap and self-service, Hetzner space hosts a huge mix of legitimate projects alongside occasional abuse, so IPs here vary widely in reputation.
- Hetzner publishes clear abuse-handling processes and acts on reports.
Interesting
- Hetzner runs large solar-powered and energy-efficient data center campuses and competes largely on price-per-performance rather than managed services.
This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy. Source, and how to suggest an edit.
Interconnection
Peering at a glance
Internet exchanges
Recorded at 29 exchanges in 13 countries, largest first.
| Exchange | Location | Their address |
|---|---|---|
| DE-CIX Frankfurt | Frankfurt, Germany | 80.81.192.98 |
| LINX LON1 | London, United Kingdom | 195.66.227.209 |
| AMS-IX Amsterdam | Amsterdam, Netherlands | 80.249.209.55 |
| Neutral Internet Exchange | Amsterdam, Netherlands | 193.239.117.110 |
| France-IX Paris | Paris, France | 37.49.237.197 |
| TPIX - Internet Exchange | Warsaw, Poland | 195.149.234.109 |
| The Frys Internet Exchange | Frysian, Netherlands | 2001:7f8:10f::616c:251 |
| Speed Internet Exchange | Dronten, Netherlands | 185.1.222.73 |
Transit providers
49 upstream, 36 downstream and 142 adjacent networks observed; most-used upstreams first.
Exchange presence is recorded rather than inferred: the directory collected by Packet Clearing House (https://www.pch.net/ixp/data) on 2026-10-28, licensed CC BY-NC-SA 3.0. Transit is inferred from observed BGP paths, never declared by either party.
Address space
Summary
IPv4 110 prefixes · 3.24M addresses IPv6 5 prefixes
| Country | Name | Prefixes |
|---|---|---|
| DE | Germany | 115 |
Registry
Allocation record
- Registry
- RIPE
- Handle
AS24940- Registry name
- HETZNER-AS
- Registrant
- HOS-GUN
- Abuse contact
- abuse@hetzner.com
- Registered
- 2002-06-03
- Last changed
- 2026-06-30
- Allocation
- allocated
Declared
PeeringDB profile
- Name
- Hetzner Online
- Network type
- Content
- Scope
- Europe
- Traffic ratio
- Mostly Outbound
- Peering policy
- Open
- IRR as-set
AS-HETZNER- Present at
- 51 exchanges
- Facilities
- 23 facilities
- Website
- https://www.hetzner.com
PeeringDB records are maintained by the network operator and are not independently verified. Treat them as a statement of intent rather than of fact. For the observed and recorded view, see peering, which lists the exchanges Packet Clearing House has a port on file for.
Routing security
RPKI and IRR
- RPKI
- 69% valid · 67 valid, 30 with no ROA
- ROAs
- 85 authorising AS24940
- ASPA
- 9 declared providers
- IRR
- 100% registered · 97 of 97 announcements
- Route objects
- 124 naming AS24940
Reputation
Classification and threat
Hosting Datacenter or cloud provider. Addresses are servers, not people.
Spamhaus DROP
Not on ASN-DROP The network as a whole is not listed.
No DROP prefixes None of its announced space is on the DROP prefix list.
Spamhaus DROP ("Don't Route Or Peer") lists space and networks run by, or hijacked for, spam and cybercrime operations: 448 networks and 1,851 prefixes, as published 2026-10-29. A short, high-confidence list, so a match is worth taking seriously, and absence from it says little on its own.
FBI IC3
5 IC3 indicators addresses in this network appear in FBI IC3 cybersecurity advisories.
| Prefix | Advisory | Published |
|---|---|---|
167.235.225.149 | #StopRansomware: SafePay Ransomware | 2026-10-20 |
188.40.81.84 | "First VPN Service" Used by Ransomware Actors to Compromise Systems | 2026-05-21 |
49.12.133.165 | "First VPN Service" Used by Ransomware Actors to Compromise Systems | 2026-05-21 |
95.216.15.11 | "First VPN Service" Used by Ransomware Actors to Compromise Systems | 2026-05-21 |
95.216.15.25 | "First VPN Service" Used by Ransomware Actors to Compromise Systems | 2026-05-21 |
IC3 threat data is alpha. Absence of an indicator is not evidence of good behaviour, only of absence from this one feed.
Elsewhere