AS24940

AS24940 is the main network of Hetzner Online, a large German hosting provider known for inexpensive dedicated servers, cloud VMs, and storage, registered under RIPE to Hetzner Online GmbH in Gunzenhausen. It originates roughly 90 IPv4 prefixes (~3.0 million addresses) and ~6 IPv6 prefixes, runs traffic in the 5–10 Tbps range that is mostly outbound, is present at around 47 IXPs with several thousand observed peers, and operates an open peering policy with a European scope. Its upstreams include Cogent, Arelion, NTT, GTT, Deutsche Telekom, Lumen, and Tata. As a multi-tenant host the standard caveat applies — an IP is a dedicated server or cloud VM that may have been reassigned among many customers over time, so reputation should bind to the current tenant rather than to Hetzner. The network is frequently the single largest source of HTTP DDoS attacks in Cloudflare's reporting: it held the number-one spot for roughly a year and retained it in the 2025 Q1 report before dropping to third in Q2 2025, and it is regularly cited in honeypot datasets for SSH brute-force and scanning. This reflects cheap, easily-provisioned compute and tenant behavior rather than operator intent, and Hetzner is well known for strict KYC and an aggressive abuse-response process that operators report results in fast suspensions. Hetzner is privately held.

Operator

Hetzner Online GmbH (RIPE org ORG-HOA1-RIPE, Gunzenhausen, Germany) [Confirmed] — RIPE WHOIS

Country / RIR

DE, RIPE [Confirmed] — RIPE WHOIS

Allocated

2002-06-03 [Confirmed] — bgp.tools

Org status

active; privately held — hetzner.com

Security/abuse context (DATED, NEUTRAL — multi-tenant)

an IP is a dedicated server or cloud VM reassigned among many customers over time; attribute to tenant. Frequently the single largest source of HTTP DDoS attacks in Cloudflare reporting — held #1 for ~a year and retained #1 in the 2025 Q1 report, then dropped to #3 in Q2 2025 (when Drei/3xK Tech AS200373 took #1, DigitalOcean #2). Regularly cited in honeypot datasets for SSH brute-force/scanning. Reflects cheap abusable compute + tenant behavior, not operator intent; noted for strict KYC and fast abuse takedowns — blog.cloudflare.com/ddos-threat-report-for-2025-q1

Network & routing

Network type

hosting-VPS / dedicated-server / cloud [Confirmed]

Size

~90 IPv4 prefixes originated (~259 announced; ~3.0M addrs), ~6 IPv6 (~73 announced) — bgp.he.net / bgp.tools (2026-06)

Routing/peering

traffic 5–10 Tbps, mostly outbound; ~47 IXPs, ~3,900 observed peers; open peering; upstreams AS174 (Cogent), AS1299 (Arelion), AS2914 (NTT), AS3257 (GTT), AS3320 (DTAG), AS3356 (Lumen), AS6453 (Tata); RPKI ~58 v4 valid, 3 v4 invalid — bgp.he.net, peeringdb.com/asn/24940

Notable usage

large German hosting provider — inexpensive dedicated servers, cloud VMs, storage; European scope — hetzner.com

Related ASNs

AS213230, AS212317 (HETZNER-CLOUD), and other Hetzner ASNs

Analyst note

Very common in triage; multi-tenant ephemeral-IP caveat applies. Expect top-of-list presence on scanning/DDoS feeds by design; Hetzner's strict KYC and fast abuse response are relevant context.