128.140.110.145📋 Copy

IP Intelligence Briefing: 128.140.110.145

Date: 2026-06-08

---

**1. Core Profile**

• Risk Score: 40 (Moderate Risk)
• Provider: Hetzner Online GmbH (ARIN-regulated)
• Geolocation:

- Country: Germany (DE)

- City: Tabriz (Iran) [Likely data inconsistency; verify]

- Coordinates: 51.17°N, 10.45°E

• Network Role:

- Cloud Compute instance (Hetzner)

- Hosting provider: Hetzner Online GmbH

- No CDN, VPN, or Tor association

---

**2. Threat Indicators**

• No malicious activity detected:

- No indicators of compromise (IOCs), spam, or known attacker campaigns.

- No DNS-based threats or malicious domain associations.

• DNS Configuration:

- PTR record: `static.145.110.140.128.clients.your-server.de`

- Domain: `your-server.de` (legitimate, but no additional security validation provided).

---

**3. Observation History**

• Single observation (June 8, 2026):

- Confirmed as a cloud-hosted server with no suspicious services or routing anomalies.

- No historical trends or persistent threats.

---

**4. Relationships**

• DNS Associations:

- Linked to `static.145.110.140.128.clients.your-server.de` (repeatedly observed).

• Network Relationships:

- Subnet: `128.140.110.145/24` (no active or malicious sibling IPs).

- Associated with network `CLOUD-NBG1` (likely Hetzner’s internal network label).

---

**5. Neighborhood Analysis**

• Subnet Abuse Density: 0% (clean).
• No neighboring IPs in the /24 subnet (likely a single-host allocation).

---

**6. Security Recommendations**

• Firewall Actions:

- Block the IP using:

- `iptables -A INPUT -s 128.140.110.145 -j DROP`

- `nft add rule inet filter input ip saddr 128.140.110.145 drop`

- Cloudflare/WAF/AWS WAF rules provided in tool response.

• Monitoring:

- Verify geolocation accuracy (Tabriz, Iran vs. Germany).

- Monitor for unexpected DNS changes or service exposure.

---

**7. Summary**

This IP is a legitimate Hetzner cloud instance with no detected malicious activity. While the geolocation data contains a potential inconsistency, the IP shows no signs of compromise. SOC teams should confirm the server’s legitimacy and ensure no unauthorized services are exposed. Use the provided firewall rules for blocking if further suspicion arises.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.