# 91.99.119.128 — IP Intelligence Summary 91.99.119.128 is an IPv4 address operated by Hetzner Online GmbH - Contact Role (AS24940), geolocated to Falkenstein, Germany. It belongs to datacenter or hosting infrastructure with reverse DNS name static.128.119.99.91.clients.your-server.de. As of October 6, 2026, IPDebrief rates it High Risk (70/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/91.99.119.128 - Last updated: 2026-10-06 ## Ownership - Organization: Hetzner Online GmbH - Contact Role - Network name: CLOUD-FSN1 - Allocated block: 91.99.112.0/20 - ASN: AS24940 (https://ipdebrief.com/asn/24940) - Regional registry: RIPE - Cloud / hosting provider: Hetzner ## Location - City: Falkenstein - Region: Saxony - Country: Germany - Time zone: Europe/Berlin ## Network classification - Infrastructure type: CloudCompute - Datacenter / hosting: yes - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: High Risk (70/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Reverse DNS - static.128.119.99.91.clients.your-server.de - Forward-confirmed: yes ## Exposed services - 80/tcp — http - 443/tcp — https - 22/tcp — ssh ## Analyst narrative \# IP INTELLIGENCE BRIEFING **Target:** 91.99.119.128/32 **Classification:** Cloud Infrastructure Node (Hetzner) **Report Date:** Current **Analyst:** IPDebrief Intelligence Platform \--- \## EXECUTIVE SUMMARY Target IP 91.99.119.128 is a Hetzner cloud compute infrastructure address located in Falkenstein, Saxony, Germany. The IP resolves to a static hostname within Hetzner's CLOUD-FSN1 network (91.99.112.0/20). Risk assessment shows mixed signals: baseline profile indicates low risk (30/100), while contextual analysis in the actions module flags moderate risk (55/100), triggering security action recommendations. No active open services were detected; the system is characterized as firewalled with no publicly accessible ports. \--- \## INFRASTRUCTURE PROFILE | Field | Value | |-------|-------| | **ASN** | 24940 (Hetzner Online GmbH) | | **Organization** | Hetzner Online GmbH - Contact Role | | **Netname** | CLOUD-FSN1 | | **CIDR Block** | 91.99.112.0/20 | | **RIR** | RIPE | | **Country** | DE (Germany) | | **City/Region** | Falkenstein, Saxony | | **Infrastructure Type** | CloudCompute | | **Classification** | Cloud Hosting, Firewalled | \--- \## NETWORK CHARACTERISTICS **DNS Resolution:** \- PTR: static.128.119.99.91.clients.your-server.de \- Forward Resolution: Forward confirmed to same hostname \- Hosted Domain: your-server.de **Service Status:** \- Open Ports: None detected \- TLS Certificate: None \- HTTP Title: None \- Server Banner: None **Control Plane Data:** \- BGP Prefix: 91.99.0.0/16 \- Route Stability: False (route changes observed in last 30 days) \- DNSSEC Valid: Yes \- DNSBL Listed: 2 of 8 total lists \--- \## THREAT ASSESSMENT **Baseline Risk Score:** 30/100 (Low Risk) **Contextual Risk Score:** 55/100 (Moderate Risk) **Abuse Confidence Score:** Not applicable **Known Attacker:** False **Spam Source:** False **Tor Exit Node:** False **Threat Indicators:** \- No active threat indicators identified \- No associated campaigns or known malware \- No evidence of proxy, VPN, or residential usage **Blacklist Status:** \- Total DNSBL Listings: 2 (out of 8 checked lists) \- Blacklist Count: 0 (traditional blacklists) \--- \## OBSERVATION HISTORY **Total Observations:** 22 signals tracked over time **Recent Activity Timeline:** \- **2026-08-04**: Listings observed with high severity (confidence 0.85) \- **2026-07-22**: Multiple geolocation signals confirming Falkenstein, Germany (confidence 0.70) \- **2026-07-22**: Operator scoring at Basic level (0.3478) **Temporal Indicators:** \- Ownership Changes: 0 \- Threat Persistence Days: 0 \- Threat Observation Count: 1 \- Persistently Malicious: False \--- \## RELATIONSHIP GRAPH **Total Relationships:** 11 **Key Associations:** \- DNS Associations: static.128.119.99.91.clients.your-server.de (multiple entries) \- Network Relationships: CLOUD-FSN1 (Hetzner cloud network) **Relationship Type Distribution:** \- DNS Association: Multiple instances \- Same Network: Multiple instances \--- \## NEIGHBORHOOD ANALYSIS **Subnet:** 91.99.119.128/24 **Abuse Density:** 0 **Classification:** Mostly Clean **Total Siblings:** 1 **Active Siblings:** 0 **Threat Siblings:** 1 **Risk Distribution:** \- High Risk: 0 \- Medium Risk: 0 \- Low Risk: 0 \--- \## RECOMMENDED ACTIONS **Risk Score:** 55/100 (Elevated) **Category:** Monitoring **Recommended Action:** Increase logging verbosity and review recent activity from this IP address. **Firewall Rules (Blocking):** \`\`\`bash \# iptables iptables -A INPUT -s 91.99.119.128 -j DROP \# nftables nft add rule inet filter input ip saddr 91.99.119.128 drop \# nginx deny 91.99.119.128; \# pfSense 91.99.119.128/32 \# Cloudflare WAF { "description": "Block 91.99.119.128 — IPDebrief risk score 55", "action": "block", "filter": { "expression": "ip.src eq 91.99.119.128" } } \# AWS WAF { "Addresses": \["91.99.119.128/32"\], "Description": "IPDebrief risk 55" } \`\`\` **Disclaimer:** These recommendations are probabilistic and should be combined with other signals before taking action. \--- \## ANALYST NOTES The IP address is part of Hetzner's cloud infrastructure and shows no evidence of direct malicious activity. However, the contextual risk score elevation (55/100) combined with recent high-severity listings warrants enhanced monitoring. The DNSBL listings (2 of 8) and elevated contextual risk suggest potential association with spam or abusive activity, though the IP itself is not flagged as a known attacker. The lack of open services indicates this is likely a backend or management node rather than a publicly facing endpoint. ## Addresses sharing infrastructure - 2.26.86.97 — Same server software (https://ipdebrief.com/2.26.86.97) - 2.27.55.108 — Same server software (https://ipdebrief.com/2.27.55.108) - 5.255.108.145 — Same server software (https://ipdebrief.com/5.255.108.145) - 14.225.217.138 — Same server software (https://ipdebrief.com/14.225.217.138) - 88.23.23.7 — Same server software (https://ipdebrief.com/88.23.23.7) - 88.138.20.172 — Same server software (https://ipdebrief.com/88.138.20.172) - 102.220.161.107 — Same server software (https://ipdebrief.com/102.220.161.107) - 103.59.161.173 — Same server software (https://ipdebrief.com/103.59.161.173) - 103.75.183.57 — Same server software (https://ipdebrief.com/103.75.183.57) - 103.75.198.228 — Same server software (https://ipdebrief.com/103.75.198.228) - 103.76.120.206 — Same server software (https://ipdebrief.com/103.76.120.206) - 104.248.218.184 — Same server software (https://ipdebrief.com/104.248.218.184) --- Source: IPDebrief, "91.99.119.128 IP intelligence", https://ipdebrief.com/91.99.119.128, updated 2026-10-06. Assessments are probabilistic.