91.98.167.31📋 Copy

# IP Intelligence Briefing: 91.98.167.31/32

## Executive Summary

IP address 91.98.167.31 is a moderate-risk cloud computing resource hosted on Hetzner Online GmbH infrastructure in Nuremberg, Germany. The address operates as a web server with standard HTTP/HTTPS services and SSH access. Risk scoring indicates moderate concern (40/100), though no active threat indicators or known campaigns were identified.

## Risk Profile

• Risk Score: 40 (Moderate Risk)
• Classification: CloudCompute/Hosting infrastructure
• Provider: Hetzner Online GmbH (AS24940)
• Network Block: 91.98.167.0/24 (CLOUD-NBG1)
• Abuse Confidence: Not classified as known attacker or spam source

## Geolocation

• Country: Germany (DE)
• Region: Bavaria
• City: Nuremberg
• Coordinates: 51.17°N, 10.45°E
• Geo Validation: Plausible (ICMP probe blocked)

## Network Services

• Open Ports: 22/SSH, 80/HTTP, 443/HTTPS
• TLS Certificate: TRAEFIK DEFAULT CERT (proxy/ingress controller)
• PTR Record: static.31.167.98.91.clients.your-server.de
• Infrastructure Type: Cloud hosting provider

## Threat Indicators

• Blacklist Status: Not listed on any known threat feeds
• DNSBL Listings: 2 of 8 total lists
• Campaign Correlation: None detected
• Tor Exit Node: No
• Known Attacker: No

## Relationship Graph

The IP maintains 41 documented relationships, including DNS associations and network topology connections to CLOUD-NBG1. No correlated malicious entities or campaign participants were identified.

## Neighborhood Analysis (91.98.167.0/24)

• Subnet Classification: Mostly clean
• Abuse Density: 0 (low)
• Neighbor Count: 1 (91.98.167.226)
• Risk Distribution: 1 medium-risk neighbor
• Inherited Risk Score: 5
• Threat Siblings: 2

## Observation History

Signal observation history contains 26 data points. Recent observations (2026-06-21) show stable geolocation and network classification. The IP demonstrates minimal threat persistence with a single threat observation recorded.

## Recommended Security Actions

Despite moderate risk classification, no automated security actions were recommended. The following rules may be implemented for defense-in-depth:

• Firewall: Block or monitor traffic from 91.98.167.31/32
• WAF Rules: Configure rules to allow traffic but monitor for anomalies
• Recommendation: Implement rate limiting and connection monitoring due to moderate risk score

## Assessment

IP 91.98.167.31 represents legitimate cloud hosting infrastructure with moderate-risk classification. The absence of known threat indicators, combined with stable geolocation and minimal neighborhood activity, suggests operational cloud services rather than malicious activity. The moderate risk score (40) warrants monitoring but does not indicate immediate threat.

Recommendation: Monitor traffic patterns and DNS activity. No immediate blocking required unless additional threat intelligence emerges.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.