185.247.137.189📋 Copy

# IP Intelligence Briefing: 185.247.137.189/32

Date: 2026-06-26

Classification: Moderate Risk (Score: 40/100)

Source: IPDebrief Intelligence Platform

---

## Executive Summary

IP address 185.247.137.189 belongs to Driftnet Hostmaster (ASN: 211298) and is geolocated to Manchester, England. The IP is classified as "Firewalled / No Services" with no open ports detected. While the IP itself shows no direct threat indicators, its /24 neighborhood exhibits mixed abuse characteristics with elevated sibling risk.

---

## Technical Profile

Ownership & Geolocation:

• Organization: Driftnet Hostmaster
• ASN: 211298
• Location: Manchester, England, GB
• CIDR Block: 185.247.137.0/24
• RIR: RIPE

Network Classification:

• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• DNS PTR: r4-189-bd.monitoring.internet-measurement.com
• Forward Resolution: r4-189-bd.monitoring.internet-measurement.com (confirmed)
• Domain: internet-measurement.com (SPF: yes, DMARC: yes)

Control Plane Indicators:

• Origin ASN: 211298
• BGP Prefix: 185.247.137.0/24
• Route Stability: False
• Route Changes (30d): 0
• DNSBL Listed: 2 of 8 total lists
• Operator Score: 0.2609 (Basic)

---

## Threat Assessment

Direct Threat Indicators:

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Campaign Association: None detected
• Blacklist Count: 0

Neighborhood Context (185.247.137.0/24):

• Total Siblings: 190
• Active Siblings: 54
• Threat Siblings: 72
• Abuse Density: 0.3789
• Classification: Mixed
• Risk Distribution: High (0), Medium (38), Low (62)

Inherited Risk Score: 15 (from subnet)

---

## Historical Observations

Observation Count: 19 signals tracked

• Geolocation: Consistent GB attribution with 500km accuracy radius
• Operator Score: Stable at 0.2609 (Basic)
• Subnet Risk: Consistent abuse density of 0.3789 across observations
• Threat Persistence: No persistent malicious activity detected

---

## Related Entities

DNS Associations:

• r4-189-bd.monitoring.internet-measurement.com (repeated association)

Network Associations:

• UK-DRIFTNET-20180301 (network registration)

---

## Recommended Actions

Based on the moderate risk profile (Score: 40), the following rules are recommended for implementation:

iptables:

```

iptables -A INPUT -s 185.247.137.189 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 185.247.137.189 drop

```

nginx:

```

deny 185.247.137.189;

```

Cloudflare WAF:

```json

{

"description": "Block 185.247.137.189 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 185.247.137.189"

}

}

```

AWS WAF:

```json

{

"Addresses": ["185.247.137.189/32"],

"Description": "IPDebrief risk 40"

}

```

---

## Analyst Notes

The IP address resolves to a monitoring infrastructure hostname (internet-measurement.com) with valid email authentication records. Despite the moderate risk score, there are no direct threat indicators. The elevated neighborhood risk (0.3789 abuse density) suggests this /24 block may contain compromised hosts. The "firewalled/no services" classification indicates the IP may be part of a passive monitoring system rather than an active service endpoint.

Recommendation: Implement blocking rules per the recommended actions. Monitor for any changes in service availability or reputation over the next 30 days.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.