87.236.176.215
IP Intelligence Briefing: 87.236.176.215
Date: 2026-06-06
---
**Risk Profile**
- Risk Score: 40 (Moderate Risk)
- Network Classification: Mixed (subnet abuse density: 4%)
- Ownership: Registered to *Driftnet Hostmaster* (AS211298), UK-based.
- Geolocation: London, United Kingdom (confirmed via 2 geolocation sources).
- Threat Indicators: No direct malicious indicators (e.g., no known attackers, spam, or blacklisted activity).
---
**Observation History**
- Recent Activity:
- Stable routing (no recent BGP changes).
- Consistent geolocation in London, UK.
- HTTP service (port 80) observed with a 302 redirect.
- Historical Trends:
- No persistent malicious activity detected over 28 observations.
- Low threat persistence (0 days of sustained risk).
---
**Network Relationships**
- DNS Associations:
- Linked to `r3-215-d7.monitoring.internet-measurement.com` (valid SPF/DMArc).
- Network Entities:
- Shares subnet with 176 IPs (40 active, 64 flagged as high-risk).
- Part of the *UK-DRIFTNET-20050831* network (Driftnet Hostmaster).
- Routing:
- BGP path: `34549 6939 211298` (stable, no route anomalies).
---
**Neighborhood Analysis**
- Subnet: `87.236.176.0/24`
- Risk Distribution:
- 4 high-risk IPs (4%), 75 medium-risk IPs (75%), 21 low-risk IPs (21%).
- Notable Neighbors:
- IPs like `87.236.176.2`, `87.236.176.3`, and `87.236.176.4` share similar risk profiles.
- 64 neighbors flagged for abuse (4% of subnet).
---
**Actionable Insights**
1. Monitor Subnet: The subnet contains a mix of risks, with 64 IPs flagged for abuse. Prioritize monitoring high-risk neighbors.
2. Verify DNS Activity: Investigate the DNS association with `internet-measurement.com` for potential benign or malicious intent.
3. Network Segmentation: Consider isolating this subnet if it hosts critical assets, given the presence of high-risk IPs.
4. Geolocation Validation: Confirm the IP’s London, UK location with additional geolocation sources due to a 500km accuracy radius.
---
Conclusion: This IP appears benign but is part of a subnet with mixed risk. No immediate action is required, but ongoing monitoring of the subnet and its neighbors is recommended.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Driftnet Hostmaster |
| ASN | AS211298 |
| Network Name | — |
| CIDR Block | 87.236.176.0/24 |
| RIR | RIPE |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | r3-215-d7.monitoring.internet-measurement.com |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | r3-215-d7.monitoring.internet-measurement.com |
🔐 DNS Hygiene
| Hygiene Score | 80% (Excellent) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Single-Service Host |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| Closed Ports | 22, 25, 443, 3389, 8080, 8443 (1 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 22% | 2 | 4 |
| routing | 27% | 2 | 3 |
| services | 22% | 2 | 4 |
| ownership | 24% | 3 | 4 |
| reputation | 19% | 1 | 3 |
| geolocation | 19% | 2 | 2 |
| Overall | 22% | 12 | 20 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (70%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-12 09:41:53 UTC |
| Last Seen | 2026-06-26 17:30:43 UTC |
| Profile Built | 2026-06-26 17:35:50 UTC |
| Data Freshness | Live |
| Signal Types | 26 |
| Total Observations | 28 |
Full dossier details are available via our API.