87.236.176.125📋 Copy

# IP Intelligence Briefing: 87.236.176.125/32

## Executive Summary

IP address 87.236.176.125 is classified as Moderate Risk (Score: 55). The address is hosted by Driftnet Hostmaster (AS211298) within the UK-DRIFTNET-20050831 network block in London, GB. The subnet exhibits mixed abuse characteristics with 34.9% abuse density across 192 total siblings. No active threat indicators were detected during the current profile assessment.

## Current Risk Profile

## Network Role & Services

• Infrastructure Type: No services detected; connection type classified as "Firewalled / No Services"
• Open Ports: None detected
• TLS/Certificates: None
• CDN/Cloud/Proxy: No
• Tor Exit Node: No

## DNS Analysis

• PTR Hostnames: r3-125-7d.monitoring.internet-measurement.com
• Forward Resolution: Confirmed (1 hostname)
• Domain: internet-measurement.com
• Email Auth: SPF and DMARC records present
• DNSBL Listings: 3 listings out of 8 total checks

## Neighborhood Assessment (87.236.176.0/24)

• Total Siblings: 192
• Active Siblings: 47
• Threat Siblings: 67
• Abuse Density: 34.9%
• Inherited Risk: 13
• Subnet Classification: Mixed
• Risk Distribution Across Neighbors: 0 High, 86 Medium, 14 Low

Key neighboring IPs include 87.236.176.2 (Risk: 40), 87.236.176.3 (Risk: 55), and 87.236.176.4 (Risk: 55).

## Threat Indicators

• Abuse Confidence Score: Not available
• Blacklist Count: 0
• Known Campaigns: None
• Is Known Attacker: No
• Is Spam Source: No
• Threat Feeds: Empty

## Historical Trend Analysis

Seven observations were tracked over the monitoring period. Notable changes include:

The subnet classification shifted from "mixed" (June 5) to "mostly clean" (June 25), indicating improved subnet hygiene or temporary mitigation. Geolocation consistency shows the IP registered in GB (London) with ASN 211298.

## Network Relationships

• Total Relationships: 31
• Primary Network Association: UK-DRIFTNET-20050831 (repeated across multiple relationship entries)
• BGP Prefix: 87.236.176.0/24

## Recommended Actions

Based on the risk profile and current threat indicators, the following actions are recommended:

1. Monitoring: Maintain observation; no immediate blocking required.

2. Blocklist Evaluation: Currently 0 blacklist hits; continue monitoring.

3. Subnet Context: Evaluate traffic patterns against the broader 87.236.176.0/24 subnet (34.9% abuse density) to determine if broader subnet restrictions are warranted.

## SOC Analyst Notes

• No active threat indicators detected against this specific IP.
• Moderate risk score primarily driven by subnet-level abuse density rather than IP-specific malicious activity.
• Historical trend shows improving subnet classification from June 5 to June 25.
• Consider implementing subnet-level monitoring policies if broader abuse patterns are observed across the 87.236.176.0/24 block.

---

*Report generated: Current session | Data Source: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.