195.96.139.61📋 Copy

# IP Intelligence Briefing: 195.96.139.61/32

## Executive Summary

The IP address 195.96.139.61 presents a Low Risk threat profile with a risk score of 25 out of 100. The address belongs to Driftnet Hostmaster (ASN 211298) within the UK-DRIFTNET-20260127 network block. No active threat indicators, malicious campaigns, or known attacker signatures were detected. Recommended action: Continue monitoring; no immediate blocking required.

---

## Network Ownership & Classification

• Organization: Driftnet Hostmaster
• ASN: 211298
• Netname: UK-DRIFTNET-20260127
• CIDR Block: 195.96.139.0/24
• RIR: RIPE
• Geolocation: GB (United Kingdom) — Note: Some geolocation signals indicate New York, NY, but this appears to be an inference discrepancy.
• Network Role: Provider infrastructure, firewalled with no active services detected

---

## Threat Intelligence Assessment

• Risk Score: 25/100 (Low Risk)
• Abuse Confidence Score: Not reported
• Threat Indicators: None detected
• Blacklist Status: 0 active blacklists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Known Campaigns: None identified

The IP demonstrates no evidence of malicious activity. The operator score is rated "Basic" (0.2609), indicating minimal operator-level threat activity.

---

## Technical Observations

• DNS: PTR hostname resolves to r5-61-3d.monitoring.internet-measurement.com
• Services: No open ports detected; classified as "Firewalled / No Services"
• SSL/TLS: No certificates detected
• DNSSEC: Valid
• Control Plane: Route stability flagged as false; 1 DNSBL listing among 8 total lists checked
• Traceroute: 29 hops; 19 timed-out hops suggesting network filtering or obfuscation

---

## Relationship Graph

The IP maintains 4 relationships, all DNS-based:

• DNS Associations: r5-61-3d.monitoring.internet-measurement.com (multiple records)
• Network Association: UK-DRIFTNET-20260127

No organizational, certificate, or IP-to-hostname relationships beyond DNS were identified.

---

## Neighborhood Analysis (195.96.139.0/24)

• Total Neighbors: 100
• Abuse Density: 0 (no abuse detected)
• Risk Distribution:

- High Risk: 0

- Medium Risk: 45

- Low Risk: 55

• Sample Sibling Risk Scores: 25-40 range observed

The subnet exhibits moderate activity with no high-risk siblings. Abuse density is negligible, suggesting the IP is part of a generally clean network block.

---

## Historical Signal Analysis

16 total observations recorded, most recent from 2026-07-24. Key historical signals:

• Consistent Organization: Driftnet Hostmaster identified across all ownership signals (95% confidence)
• Geolocation: Consistent GB attribution with 52% confidence; some signals show 500km accuracy radius
• Operator Classification: "Basic" level maintained across observations

No escalation in risk profile or threat activity observed over time.

---

## Security Recommendations

No specific firewall rules or blocking actions recommended. The IP demonstrates:

• Low threat activity
• No known malicious associations
• Stable operational characteristics

Recommended Actions:

1. Continue standard monitoring

2. Log traffic for baseline reference

3. No immediate blocking or filtering required

---

## SOC Analyst Notes

This IP represents legitimate infrastructure with no current threat intelligence. The absence of open services, combined with zero blacklist entries and no known campaign associations, supports a "allow with monitoring" posture. The geolocation inconsistency (GB vs. NY) warrants periodic verification but does not indicate compromise.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.