91.99.119.128📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 91.99.119.128/32

Classification: Cloud Infrastructure Node (Hetzner)

Report Date: Current

Analyst: IPDebrief Intelligence Platform

---

## EXECUTIVE SUMMARY

Target IP 91.99.119.128 is a Hetzner cloud compute infrastructure address located in Falkenstein, Saxony, Germany. The IP resolves to a static hostname within Hetzner's CLOUD-FSN1 network (91.99.112.0/20). Risk assessment shows mixed signals: baseline profile indicates low risk (30/100), while contextual analysis in the actions module flags moderate risk (55/100), triggering security action recommendations. No active open services were detected; the system is characterized as firewalled with no publicly accessible ports.

---

## INFRASTRUCTURE PROFILE

---

## NETWORK CHARACTERISTICS

DNS Resolution:

• PTR: static.128.119.99.91.clients.your-server.de
• Forward Resolution: Forward confirmed to same hostname
• Hosted Domain: your-server.de

Service Status:

• Open Ports: None detected
• TLS Certificate: None
• HTTP Title: None
• Server Banner: None

Control Plane Data:

• BGP Prefix: 91.99.0.0/16
• Route Stability: False (route changes observed in last 30 days)
• DNSSEC Valid: Yes
• DNSBL Listed: 2 of 8 total lists

---

## THREAT ASSESSMENT

Baseline Risk Score: 30/100 (Low Risk)

Contextual Risk Score: 55/100 (Moderate Risk)

Abuse Confidence Score: Not applicable

Known Attacker: False

Spam Source: False

Tor Exit Node: False

Threat Indicators:

• No active threat indicators identified
• No associated campaigns or known malware
• No evidence of proxy, VPN, or residential usage

Blacklist Status:

• Total DNSBL Listings: 2 (out of 8 checked lists)
• Blacklist Count: 0 (traditional blacklists)

---

## OBSERVATION HISTORY

Total Observations: 22 signals tracked over time

Recent Activity Timeline:

• 2026-08-04: Listings observed with high severity (confidence 0.85)
• 2026-07-22: Multiple geolocation signals confirming Falkenstein, Germany (confidence 0.70)
• 2026-07-22: Operator scoring at Basic level (0.3478)

Temporal Indicators:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 1
• Persistently Malicious: False

---

## RELATIONSHIP GRAPH

Total Relationships: 11

Key Associations:

• DNS Associations: static.128.119.99.91.clients.your-server.de (multiple entries)
• Network Relationships: CLOUD-FSN1 (Hetzner cloud network)

Relationship Type Distribution:

• DNS Association: Multiple instances
• Same Network: Multiple instances

---

## NEIGHBORHOOD ANALYSIS

Subnet: 91.99.119.128/24

Abuse Density: 0

Classification: Mostly Clean

Total Siblings: 1

Active Siblings: 0

Threat Siblings: 1

Risk Distribution:

• High Risk: 0
• Medium Risk: 0
• Low Risk: 0

---

## RECOMMENDED ACTIONS

Risk Score: 55/100 (Elevated)

Category: Monitoring

Recommended Action: Increase logging verbosity and review recent activity from this IP address.

Firewall Rules (Blocking):

```bash

# iptables

iptables -A INPUT -s 91.99.119.128 -j DROP

# nftables

nft add rule inet filter input ip saddr 91.99.119.128 drop

# nginx

deny 91.99.119.128;

# pfSense

91.99.119.128/32

# Cloudflare WAF

{

"description": "Block 91.99.119.128 — IPDebrief risk score 55",

"action": "block",

"filter": {

"expression": "ip.src eq 91.99.119.128"

}

}

# AWS WAF

{

"Addresses": ["91.99.119.128/32"],

"Description": "IPDebrief risk 55"

}

```

Disclaimer: These recommendations are probabilistic and should be combined with other signals before taking action.

---

## ANALYST NOTES

The IP address is part of Hetzner's cloud infrastructure and shows no evidence of direct malicious activity. However, the contextual risk score elevation (55/100) combined with recent high-severity listings warrants enhanced monitoring. The DNSBL listings (2 of 8) and elevated contextual risk suggest potential association with spam or abusive activity, though the IP itself is not flagged as a known attacker. The lack of open services indicates this is likely a backend or management node rather than a publicly facing endpoint.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.