138.201.32.25📋 Copy

IP Intelligence Briefing: 138.201.32.25

Date: 2026-06-10

---

**1. Core Profile**

• Risk Score: Moderate (50/100)
• Provider: Hetzner Online GmbH (AS24940)
• Geolocation: Germany (Saxony, Falkenstein)
• Network Role: Hosting provider (cloud server)
• Services:

- HTTP/HTTPS (port 80/443)

- SSH (port 22)

- TLS certificate: Valid (Let’s Encrypt, CN=admin.iwillfly.in)

• Ownership:

- ASN: AS24940 (Hetzner)

- Subnet: 138.201.32.0/24

- No recent ownership changes

---

**2. Threat Indicators**

• No direct malicious activity detected:

- No known attacker, spam, or Tor exit node associations.

- No active threat indicators (malware, C2, phishing).

• DNSBL Listings:

- Flagged in 2/8 DNSBLs (e.g., Spamhaus, OpenBL), suggesting potential abuse.

• TLS/SSL:

- Valid certificate with SANs pointing to `iwillfly.in` and subdomains.

- No self-signed or expired certificates.

---

**3. Observation History (30 Days)**

• DNS Activity:

- Persistent DNS records for `static.25.32.201.138.clients.your-server.de`.

- SPF/DKIM/DMArc configured for `your-server.de` (SPF: `v=spf1 mx -all`, DMARC: `p=none`).

• Network Stability:

- Stable routing (no recent BGP changes).

- No suspicious traffic patterns or port scans.

• Risk Trends:

- Moderate risk score consistent over time.

---

**4. Relationships & Network Context**

• DNS Associations:

- Linked to `your-server.de` (hosted domains: `iwillfly.in`, `admin.iwillfly.in`).

- CAA records present, indicating domain validation.

• Network Peers:

- Part of Hetzner’s `HETZNER-fsn1-dc8` network (data center in Falkenstein).

- No suspicious subnets or peer relationships.

---

**5. Neighborhood Analysis**

• Subnet: 138.201.32.0/24 (clean, no abuse density).
• Neighbors:

- No active sibling IPs in the subnet (neighborCount: 0).

- Subnet classified as "clean" with no high-risk IPs.

---

**6. Recommendations**

• Monitor DNSBL Flags: Investigate why the IP is listed in 2 DNSBLs (e.g., Spamhaus, OpenBL).
• Validate Hosting Use: Confirm the server’s legitimate use case for `iwillfly.in` domains.
• Secure DNS: Ensure SPF/DKIM/DMArc records are maintained for `your-server.de`.
• Firewall Rules: Consider blocking DNSBL lists if the IP is suspected of abuse.

---

Conclusion:

138.201.32.25 is a legitimate Hetzner-hosted server with no direct malicious activity. While DNSBL listings suggest potential abuse, no confirmed threats were found. SOC teams should monitor DNSBL associations and validate the server’s intended use.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.