138.199.29.201📋 Copy

## IP Intelligence Briefing: 138.199.29.201/32

Classification: Moderate Risk (Risk Score: 40)

Analysis Date: Current session

Executive Summary

IP address 138.199.29.201 is a single-service host located in London, England (GB), registered under ASN 212238 (DATACAMP-MNT) within ARIN. The IP presents moderate risk with a risk score of 40. While current threat indicators show no active malicious activity, the IP resides in a subnet (138.199.29.0/24) classified as high abuse with elevated neighbor risk profiles.

Network Characteristics

• Organization: DATACAMP-MNT
• ASN: 212238
• Country/Region: GB, England, London
• Geographic Consensus: Validated across multiple sources (geoPlausible: true)
• DNS PTR: unn-138-199-29-201.datapacket.com
• Forward Resolution: Confirmed to datapacket.com domain

Threat Intelligence Profile

• Risk Score: 40 (Moderate Risk)
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0
• Abuse Confidence Score: Not applicable
• Known Campaigns: None identified
• DNSBL Listings: 8 total lists
• Reputation Sources: Multiple, no active threat indicators

Service Fingerprint

• Open Ports: TCP/8443 (https-alt)
• TLS Certificate: Not detected
• HTTP Banner: Not detected
• Service Type: Single-Service Host

Neighborhood Context

The /24 subnet (138.199.29.0/24) exhibits elevated abuse characteristics:

• Abuse Density: High
• Subnet Classification: high_abuse
• Total Siblings: 7
• Active Siblings: 7
• Threat Siblings: 7
• Inherited Risk Score: 17
• Neighbor Risk Distribution: All 6 neighboring IPs show risk score of 40 (medium risk)

Notable neighbors include: 138.199.29.133, 138.199.29.151, 138.199.29.161, 138.199.29.193, 138.199.29.231, and 138.199.29.238 (all with risk score 40 and authority score 50).

Relationship Graph

The IP shows 31 total relationships:

• Network Associations: Multiple entries for CDNEXT-LON (London datacenter)
• DNS Associations: 18 associations with unn-138-199-29-201.datapacket.com

Historical Observations

Analysis of 23 signal observations reveals:

• Latest Observation: 2026-06-22 (minimal operator score)
• Previous Alert: 2026-06-17 showed 1 listing with high severity across 8 blacklist sources
• Geographic Inference: Historical data confirmed GB location with 500km accuracy radius
• Threat Persistence: 0 threat persistence days (not persistently malicious)

Control Plane Assessment

• Route Stability: False
• BGP Prefix: 138.199.28.0/23
• Origin ASN: 212238
• DNSSEC Valid: Yes
• Operator Score: 0.1304 (Minimal)
• MoAS Status: No

Recommended Security Actions

Based on the risk profile, the following firewall rules are recommended:

iptables:

```bash

iptables -A INPUT -s 138.199.29.201 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 138.199.29.201 drop

```

nginx:

```nginx

deny 138.199.29.201;

```

AWS WAF:

```json

{

"Addresses": ["138.199.29.201/32"],

"Description": "IPDebrief risk 40"

}

```

Cloudflare WAF:

```json

{

"description": "Block 138.199.29.201 — IPDebrief risk score 40",

"action": "block",

"filter": {"expression": "ip.src eq 138.199.29.201"}

}

```

Intelligence Assessment

This IP address represents a moderate-risk asset operating in a London-based datacenter environment. While current threat indicators do not show active malicious behavior, the subnet's high abuse classification and consistent risk scores across neighbors warrant monitoring. The IP appears to be a legitimate single-service host (datapacket.com) with proper DNSSEC validation.

Recommendation: Apply blocking rules per the firewall configurations above, particularly if this IP was observed in connection with suspicious activity. Continue monitoring the subnet for correlated behavior given the elevated neighborhood risk profile.

---

*Intelligence produced by IPDebrief analysis tools. Review and validate before operational implementation.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.