91.107.249.125📋 Copy

# IP INTELLIGENCE BRIEFING: 91.107.249.125/32

## EXECUTIVE SUMMARY

IP address 91.107.249.125 is a Hetzner cloud infrastructure endpoint with moderate risk classification (risk score 40). No active threat indicators detected, though the IP shows historical DNSBL presence on 2 of 8 reputation lists. The address operates within Hetzner's CLOUD-NBG1 cloud network in Germany with no currently open services.

## OWNERSHIP AND INFRASTRUCTURE

• Provider: Hetzner Online GmbH (AS24940)
• Network: CLOUD-NBG1 (91.107.240.0/20)
• Infrastructure Type: CloudCompute
• Status: Cloud-hosted, firewalled endpoint with no open services

## GEOLOCATION ANALYSIS

• Reported Location: Tehran, Iran (51.17°N, 10.45°E)
• Consensus: Single geo-source with 400km accuracy radius
• Validation: GeoPlausible validation failed; geolocation inconsistency noted
• Timezone: Europe/Berlin (discrepancy with Tehran coordinates)
• Note: Geographic data shows inconsistencies requiring correlation with actual traffic patterns

## THREAT POSTURE

• Risk Score: 40/100 (Moderate Risk)
• Abuse Confidence: Null
• Threat Indicators: None detected
• Blacklist Status: Listed on 2 of 8 DNSBL feeds
• Tor Exit: No
• Known Attacker: No
• Spam Source: No

## NETWORK BEHAVIOR

• Services: Firewalled/No services detected (no open ports)
• DNS Resolution: Static hostname static.125.249.107.91.clients.your-server.de
• Reverse DNS: Confirmed forward resolution
• Route Stability: Not stable (route changes observed within 30-day window)
• Control Plane: Origin ASN 24940, BGP prefix 91.107.128.0/17

## OBSERVATION HISTORY

• Total Observations: 22
• Recent Activity: Observations recorded June 2026
• Signal Persistence: Consistent operator score of 0.3478 across observations
• Threat Persistence: 0 days (not persistently malicious)
• Signal Types: Basic network signals, DNS associations, routing data

## NEIGHBORHOOD ANALYSIS

• Subnet: 91.107.249.125/24
• Abuse Density: 0.5
• Total Siblings: 2
• Active Siblings: 1
• Threat Siblings: 1
• Neighbor IP: 91.107.249.89 (risk score 25, authority score 60)
• Subnet Classification: Mostly clean

## RELATIONSHIP MAPPING

• DNS Associations: 14 relationships to static.125.249.107.91.clients.your-server.de
• Network Associations: Multiple relationships to CLOUD-NBG1 network
• Organizational Links: None identified
• Campaign Correlations: 0 correlated IPs, 0 certificate matches

## SOC ACTIONABLE INTELLIGENCE

RECOMMENDATION: MONITOR

This IP presents moderate risk primarily due to:

1. DNSBL listings on 2 reputation lists indicating historical abuse

2. Geographic data inconsistencies requiring traffic correlation

3. Non-stable routing configuration

FIREWALL CONSIDERATIONS

• No immediate blocking recommended due to absence of active threat indicators
• Monitor for service openings or behavioral changes
• Consider geo-blocking if Tehran location is legitimate for business operations

MONITORING PRIORITY

• Priority: Medium
• Rationale: Cloud infrastructure with historical DNSBL presence but no current malicious indicators
• Key Indicators to Track: DNSBL status changes, service openings, geographic consistency

---

*Generated: 2026-06-29*

*Data Source: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.