91.107.200.30📋 Copy

# IP Intelligence Briefing: 91.107.200.30

## Executive Summary

IP address 91.107.200.30 is a Hetzner cloud compute endpoint with a low-risk reputation score of 25. The IP operates within the CLOUD-FSN1 network block (91.107.192.0/20) and serves as a static host for the your-server.de infrastructure. While the primary geolocation indicates Falkenstein, Germany, historical observations reveal geolocation inconsistencies including Tehran, Iran detections.

## Infrastructure Profile

• IP Address: 91.107.200.30/32
• Provider: Hetzner Online GmbH (AS24940)
• Network Block: CLOUD-FSN1 (91.107.192.0/20)
• Geolocation: Falkenstein, Saxony, Germany (primary); Tehran, Iran (historical observation)
• Infrastructure Type: Cloud Compute / Multi-Service Host
• DNS Resolution: static.30.200.107.91.clients.your-server.de
• Open Services: TCP/80 (HTTP), TCP/22 (SSH)
• Web Server: nginx/1.24.0 (Ubuntu)
• HTTP Response: 401 Unauthorized

## Threat Assessment

Current Risk Score: 25 (Low Risk)

• Abuse Confidence: Not available
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Blacklist Count: 0 (current); 1 of 8 DNSBL lists (historical)
• Threat Observation Count: 1
• Persistent Malicious Activity: False

## Observational History

The IP has generated 24 signals over the observation period. Key historical indicators include:

• 2026-06-29: Alienvault OTX detection showing Tehran, Iran geolocation with threat indicators (confidence: 0.75)
• 2026-06-21: DNS and certificate validation signals for your-server.de domain
• Geolocation Discrepancy: Primary data indicates Falkenstein, DE (400km accuracy radius), while probe data shows average RTT of 119ms from Falkenstein with a minimum possible RTT of 9.1ms

## Network Neighborhood Analysis

• Subnet: 91.107.200.30/24
• Classification: Mostly Clean
• Abuse Density: 0 (neighborhood assessment) / 1 (profile assessment)
• Active Siblings: 1
• Threat Siblings: 1
• Risk Distribution: No high-risk neighbors identified

## Relationships Graph

• 39 total relationships identified
• Multiple "Same Network" associations to CLOUD-FSN1
• DNS association to hostname: static.30.200.107.91.clients.your-server.de
• No direct connections to known threat campaigns

## Recommended Actions

Status: Monitor - No immediate blocking required

1. Traffic Analysis: Monitor inbound connections on TCP/80 and TCP/22 for anomalous patterns

2. Geolocation Verification: Investigate Tehran, Iran detection from 2026-06-29 for potential routing anomalies or compromised infrastructure

3. DNSBL Monitoring: Track DNSBL listing changes (currently 1 of 8 lists)

4. Route Stability: Note that isRouteStable flag is false; monitor for BGP prefix changes

Firewall Considerations: No specific iptables/nftables rules generated based on current risk profile. Standard monitoring practices apply for Hetzner cloud infrastructure.

---

*Report generated: 2026-06-29*

*Source: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.