78.47.104.140📋 Copy

# IP Intelligence Briefing: 78.47.104.140/32

Date: 2026-08-13

Classification: Moderate Risk

Risk Score: 40

## Executive Summary

IP address 78.47.104.140 is a Hetzner cloud infrastructure address associated with the your-server.de hosting domain. The IP maintains a moderate risk profile with a score of 40. No active threat indicators were identified, though DNSBL listings indicate prior reputation issues. The address is classified as cloud compute infrastructure with no open services detected.

## Network Ownership & Infrastructure

• Provider: Hetzner Online GmbH (AS24940)
• Network: CLOUD-FSN1 (78.47.104.136/29)
• Infrastructure Type: CloudCompute / Hosting
• Geolocation: Falkenstein, Saxony, Germany (DE)
• DNS PTR: static.140.104.47.78.clients.your-server.de

The IP is hosted on Hetzner's Falkenstein datacenter infrastructure. The network is stable with no ownership changes observed.

## Threat Assessment

• DNSBL Status: Listed on 2 of 8 blacklist sources
• Threat Indicators: None currently identified
• Campaign Association: No known campaigns matched
• Attack Activity: No known attacker status
• Tor/Proxy: Not identified as Tor exit node or proxy

## Observations Timeline

Twenty-nine signal observations were recorded. Recent activity includes:

• SSH version detection (OpenSSH_9.6p1 Ubuntu-3ubuntu13.18)
• Operator scoring at "Basic" level
• Multiple geolocation inference signals
• DNSBL listing events with high severity ratings

## Neighborhood Analysis

• Subnet: 78.47.104.140/24
• Abuse Density: 0 (mostly clean)
• Classification: mostly_clean
• Threat Siblings: 1 threat sibling identified in subnet

## Recommended Actions

Based on the moderate risk profile (40), the following firewall rules are recommended:

iptables:

```

iptables -A INPUT -s 78.47.104.140 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 78.47.104.140 drop

```

nginx:

```

deny 78.47.104.140;

```

Cloudflare WAF:

Block with expression: `ip.src eq 78.47.104.140`

AWS WAF:

Add 78.47.104.140/32 to blocked addresses list

## Intelligence Narrative

The IP address 78.47.104.140 operates within Hetzner's cloud infrastructure network in Germany. While the subnet maintains a mostly clean classification, the individual IP shows historical DNSBL listings and moderate risk characteristics typical of hosted cloud services. No active malicious indicators were present during the investigation window. The address resolves to your-server.de, a legitimate hosting domain with valid email authentication (SPF, DMARC). SOC teams may consider blocking based on organizational policy for moderate-risk cloud IPs, though no active threat signals warrant immediate escalation.

Status: Monitor / Block (Policy Dependent)

Confidence: Moderate

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.