116.203.187.155📋 Copy

# IP Intelligence Briefing: 116.203.187.155/32

## Executive Summary

IP address 116.203.187.155 is a web server hosting service operating on Hetzner Online GmbH infrastructure in Nuremberg, Germany. The IP carries a moderate risk score of 40 and serves the Greek domain aea.gr. While the IP demonstrates no active threat indicators in current assessments, the moderate risk classification warrants continued monitoring.

## Technical Profile

## Service & DNS Analysis

• Open Ports: TCP/80 (HTTP), TCP/443 (HTTPS)
• Web Server: nginx (EasyEngine 3.7.5)
• TLS Certificate: Let's Encrypt (R13), issued for aea.gr
• DNS PTR Record: static.155.187.203.116.clients.your-server.de
• SPF/DMARC: SPF record configured for aea.gr; DMARC status pending validation

## Threat Intelligence

• Blacklist Status: No confirmed blacklist hits in current assessment
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Correlation: No known campaign matches
• Control Plane: Route stable (0 route changes in 30 days), DNSSEC valid

## Temporal Analysis

• Observation Count: 21 historical signals recorded
• Threat Persistence: 0 days (not persistently malicious)
• Recent Activity: Consistent geolocation to Germany; provider identification stable
• Ownership Changes: 0 recorded

## Network Neighborhood Assessment

The /24 subnet (116.203.187.155/24) shows:

• Abuse Density: 0
• Classification: mostly_clean
• Threat Siblings: 1 detected
• Active Siblings: 1
• Overall: Subnet demonstrates low abuse activity

## Recommended Security Actions

Based on the IP's risk profile, the following blocking rules are recommended:

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 116.203.187.155 -j DROP

# nftables

nft add rule inet filter input ip saddr 116.203.187.155 drop

```

WAF/CDN Blocking:

• Cloudflare WAF: Block IP with expression `ip.src eq 116.203.187.155`
• AWS WAF: Add address 116.203.187.155/32 to block list

## Intelligence Notes

The moderate risk score (40) stems from hosting infrastructure classification rather than active malicious behavior. The IP serves legitimate hosting functions for the Greek domain aea.gr. However, the presence of one threat sibling in the subnet suggests potential related activity that warrants awareness. No immediate malicious indicators were observed during the assessment period.

Recommended SOC Action: Monitor for any changes in reputation score or the emergence of threat indicators. Current risk level does not warrant immediate takedown but should be included in routine threat monitoring.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.