# 195.96.139.61 — IP Intelligence Summary 195.96.139.61 is an IPv4 address operated by Driftnet Hostmaster (AS211298), geolocated to London, United Kingdom. Its reverse DNS name is r5-61-3d.monitoring.internet-measurement.com. As of November 6, 2026, IPDebrief rates it Moderate Risk (50/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/195.96.139.61 - Last updated: 2026-11-06 ## Ownership - Organization: Driftnet Hostmaster - Network name: UK-DRIFTNET-20260127 - Allocated block: 195.96.139.0/24 - ASN: AS211298 (https://ipdebrief.com/asn/211298) - Regional registry: RIPE ## Location - City: London - Region: ENG - Country: United Kingdom - Time zone: Europe/London ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Moderate Risk (50/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Reverse DNS - r5-61-3d.monitoring.internet-measurement.com - Forward-confirmed: yes ## Analyst narrative \# IP Intelligence Briefing: 195.96.139.61/32 \## Executive Summary The IP address 195.96.139.61 presents a **Low Risk** threat profile with a risk score of 25 out of 100. The address belongs to Driftnet Hostmaster (ASN 211298) within the UK-DRIFTNET-20260127 network block. No active threat indicators, malicious campaigns, or known attacker signatures were detected. Recommended action: Continue monitoring; no immediate blocking required. \--- \## Network Ownership & Classification \- **Organization:** Driftnet Hostmaster \- **ASN:** 211298 \- **Netname:** UK-DRIFTNET-20260127 \- **CIDR Block:** 195.96.139.0/24 \- **RIR:** RIPE \- **Geolocation:** GB (United Kingdom) — Note: Some geolocation signals indicate New York, NY, but this appears to be an inference discrepancy. \- **Network Role:** Provider infrastructure, firewalled with no active services detected \--- \## Threat Intelligence Assessment \- **Risk Score:** 25/100 (Low Risk) \- **Abuse Confidence Score:** Not reported \- **Threat Indicators:** None detected \- **Blacklist Status:** 0 active blacklists \- **Tor Exit Node:** No \- **Known Attacker:** No \- **Spam Source:** No \- **Known Campaigns:** None identified The IP demonstrates no evidence of malicious activity. The operator score is rated "Basic" (0.2609), indicating minimal operator-level threat activity. \--- \## Technical Observations \- **DNS:** PTR hostname resolves to r5-61-3d.monitoring.internet-measurement.com \- **Services:** No open ports detected; classified as "Firewalled / No Services" \- **SSL/TLS:** No certificates detected \- **DNSSEC:** Valid \- **Control Plane:** Route stability flagged as false; 1 DNSBL listing among 8 total lists checked \- **Traceroute:** 29 hops; 19 timed-out hops suggesting network filtering or obfuscation \--- \## Relationship Graph The IP maintains 4 relationships, all DNS-based: \- **DNS Associations:** r5-61-3d.monitoring.internet-measurement.com (multiple records) \- **Network Association:** UK-DRIFTNET-20260127 No organizational, certificate, or IP-to-hostname relationships beyond DNS were identified. \--- \## Neighborhood Analysis (195.96.139.0/24) \- **Total Neighbors:** 100 \- **Abuse Density:** 0 (no abuse detected) \- **Risk Distribution:** \- High Risk: 0 \- Medium Risk: 45 \- Low Risk: 55 \- **Sample Sibling Risk Scores:** 25-40 range observed The subnet exhibits moderate activity with no high-risk siblings. Abuse density is negligible, suggesting the IP is part of a generally clean network block. \--- \## Historical Signal Analysis 16 total observations recorded, most recent from 2026-07-24. Key historical signals: \- **Consistent Organization:** Driftnet Hostmaster identified across all ownership signals (95% confidence) \- **Geolocation:** Consistent GB attribution with 52% confidence; some signals show 500km accuracy radius \- **Operator Classification:** "Basic" level maintained across observations No escalation in risk profile or threat activity observed over time. \--- \## Security Recommendations No specific firewall rules or blocking actions recommended. The IP demonstrates: \- Low threat activity \- No known malicious associations \- Stable operational characteristics **Recommended Actions:** 1. Continue standard monitoring 2. Log traffic for baseline reference 3. No immediate blocking or filtering required \--- \## SOC Analyst Notes This IP represents legitimate infrastructure with no current threat intelligence. The absence of open services, combined with zero blacklist entries and no known campaign associations, supports a "allow with monitoring" posture. The geolocation inconsistency (GB vs. NY) warrants periodic verification but does not indicate compromise. ## Nearby addresses - 195.96.139.2 (https://ipdebrief.com/195.96.139.2) - 195.96.139.3 (https://ipdebrief.com/195.96.139.3) - 195.96.139.4 (https://ipdebrief.com/195.96.139.4) - 195.96.139.5 (https://ipdebrief.com/195.96.139.5) - 195.96.139.6 (https://ipdebrief.com/195.96.139.6) - 195.96.139.7 (https://ipdebrief.com/195.96.139.7) - 195.96.139.8 (https://ipdebrief.com/195.96.139.8) - 195.96.139.9 (https://ipdebrief.com/195.96.139.9) - 195.96.139.10 (https://ipdebrief.com/195.96.139.10) - 195.96.139.11 (https://ipdebrief.com/195.96.139.11) - 195.96.139.12 (https://ipdebrief.com/195.96.139.12) - 195.96.139.13 (https://ipdebrief.com/195.96.139.13) --- Source: IPDebrief, "195.96.139.61 IP intelligence", https://ipdebrief.com/195.96.139.61, updated 2026-11-06. Assessments are probabilistic.