91.98.215.154📋 Copy

IP Intelligence Briefing: 91.98.215.154

Date: 2026-06-15

---

**1. Risk Profile**

• Risk Score: Moderate (40/100)
• Provider: Hetzner Online GmbH (ASN 24940)
• Geolocation: Germany (DE), coordinates 51.17°N, 10.45°E
• Network Role: CloudCompute infrastructure (Hosting, Web Server)
• Threat Indicators: No malicious activity detected (zero threat feeds, no blacklists, no campaign associations).

---

**2. Network & Subnet Analysis**

• Subnet: 91.98.215.154/24
• Abuse Density: 1/10 (low risk)
• Neighboring IPs: No active IPs identified in the subnet (neighbors tool returned zero results).
• BGP Context:

- Origin ASN: 24940 (HOS-GUN)

- BGP Prefix: 91.98.0.0/16

- Route Stability: Unstable (routeChanges30d = 0, isRouteStable = false).

---

**3. Service & Technical Observations**

• Open Ports:

- TCP 80 (HTTP), 443 (HTTPS), 22 (SSH)

- SSH Banner: `SSH-2.0-OpenSSH_10.0p2 Debian-7`

• Web Server:

- Caddy HTTP/2 server (Gunicorn backend)

- HTTP/2 enabled, HSTS headers, CSP, and CSP headers configured.

- No suspicious banners or certificates detected.

• DNS:

- PTR hostname: `static.154.215.98.91.clients.your-server.de`

- SPF/DKIM/DMARC records present (no email-based threats detected).

---

**4. Temporal & Behavioral Trends**

• Observation History:

- Two distinct observations (June 7 and 14, 2026) showing consistent HTTP/2 service behavior.

- No significant changes in risk scores or network activity.

• Persistence:

- No signs of persistent malicious activity (threatPersistenceDays = 0).

---

**5. Relationships & Associations**

• DNS Associations:

- Linked to `your-server.de` (hostname: `static.154.215.98.91.clients.your-server.de`).

• Network Relationships:

- Shared subnet with HOS-GUN (ASN 24940).

- No correlated IPs or campaigns detected.

---

**6. Recommendations**

• Monitor: Track changes in BGP routes or DNS records for the subnet.
• Secure: Ensure web server (Caddy/Gunicorn) is patched and configured with strict security headers.
• Investigate: Verify ownership of `your-server.de` and check for unauthorized subdomains.
• Firewall: Consider blocking unused ports (e.g., 80/443) if non-essential for the service.

---

Tools Used: ipdebrief_profile, ipdebrief_history, ipdebrief_relationships, ipdebrief_neighbors.

Note: No immediate threat detected, but ongoing monitoring is advised due to cloud infrastructure risks.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.