87.236.176.118📋 Copy

# IP Intelligence Briefing: 87.236.176.118/32

## Executive Summary

IP address 87.236.176.118 presents a Moderate Risk profile (Risk Score: 40) with geographic inconsistencies and DNSBL listings. The address is registered to Driftnet Hostmaster (AS211298) but historical data shows associations with multiple organizations including AS29529 (itecom bvba, Belgium). The IP should be monitored for potential abuse activity.

## Key Indicators

Network Classification & Ownership

• ASN: 211298 (Driftnet Hostmaster)
• Network: 87.236.176.0/24 (RIR: RIPE)
• Geolocation: London, GB (consensus-based; 500km accuracy radius)
• Registration: Ripe registry, abuse contact available via RDAP
• Role: Single-Service Host

Threat Indicators

• DNSBL Listed: 2 of 8 total lists
• Risk Score: 40 (Moderate)
• Abuse Density: 0.3523 (35.23% in /24 subnet)
• Not classified as Tor exit, known attacker, spam source, or proxy
• Status Code: 302 (HTTP redirect)

DNS & Hostnames

• PTR Record: r3-118-76.monitoring.internet-measurement.com
• Reverse DNS: Confirmed
• No hosted domains or email authentication records observed

Open Services

• Port 80/tcp: HTTP service active
• Banner: None captured
• HTTP Version: 1.1

## Neighborhood Analysis

The /24 subnet (87.236.176.0/24) exhibits mixed classification:

• Total Siblings: 193
• Active Siblings: 47
• Threat Siblings: 68
• Risk Distribution: 0 high-risk, 86 medium-risk, 14 low-risk
• Abuse Density: 0.3523

This elevated neighbor risk score suggests potential infrastructure sharing or coordinated activity within the subnet.

## Historical Observations

Signal history reveals 21 observations with notable patterns:

• Geographic Inconsistencies: Historical data shows association with Belgium (AS29529, AlienVault OTX) alongside UK registration
• Threat Correlations: One observation flagged with 50 threat pulses from AlienVault OTX
• Network Consistency: Subnet classification and abuse density observations remain stable
• DNS Consistency: Reverse DNS associations remain constant across observations

## Recommended Actions

Immediate Mitigation

Block traffic at perimeter devices:

```bash

# iptables

iptables -A INPUT -s 87.236.176.118 -j DROP

# nftables

nft add rule inet filter input ip saddr 87.236.176.118 drop

# pfSense

87.236.176.118/32

# Cloudflare WAF

{"description":"Block 87.236.176.118 — IPDebrief risk score 40","action":"block","filter":{"expression":"ip.src eq 87.236.176.118"}}

# AWS WAF

{"Addresses":["87.236.176.118/32"],"Description":"IPDebrief risk 40"}

```

Monitoring Recommendations

1. Monitor for lateral movement: 68 threat-sibling IPs in the /24 subnet warrant correlation analysis

2. Track geolocation shifts: Historical inconsistencies between GB and BE registrations suggest potential infrastructure changes or spoofing

3. Review DNSBL status: 2 blacklist listings may indicate spam or abuse activity

4. Correlate with AS29529: Historical association with itecom bvba (Belgium) should be investigated for network-level threats

## Risk Assessment

This IP presents moderate risk due to DNSBL listings, elevated neighborhood abuse density, and geographic inconsistencies. The lack of classification as a known attacker or spam source does not eliminate risk—monitoring and blocking at perimeter is recommended while correlating with additional threat intelligence sources.

Classification: Moderate Risk — Monitor/Block at Perimeter

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.