131.222.247.79
# IP Intelligence Briefing: 131.222.247.79/32
Classification: Moderate Risk (Score: 40/100)
Date of Analysis: Current Session
Primary Location: Antakya, Hatay, Turkey (TR)
---
## Executive Summary
IP 131.222.247.79 presents a moderate risk profile with active DNSBL listings despite lacking confirmed malicious activity. The IP is classified as "clean" within its subnet but warrants defensive blocking due to blacklist associations. No active threat campaigns or persistent malicious behavior observed.
---
## Network Attribution & Infrastructure
- ASN: 216472 (HS-SYR - High Speed For Internet Services L.L.C, SY)
- Organization: IPv4 Center
- Network: TR-HSPEED-20250608 /131.222.247.0/24
- RIR Registration: ARIN (allocated 1990-04-06)
- Geolocation: Turkey, Hatay, Antakya (Lat: 36.21, Lon: 36.16)
- Service Status: Firewalled / No Services (no open ports detected)
---
## Threat Indicators
- DNSBL Listings: 2 of 8 total lists (High severity)
- Tor Exit Node: No
- Known Attacker: No
- Campaign Activity: None correlated
- Abuse Confidence Score: Not assigned
---
## Subnet Context (131.222.247.0/24)
- Abuse Density: 0%
- Subnet Classification: Clean
- Total Siblings: 4 (3 active)
- Neighbor Risk Distribution:
- 131.222.247.50: Risk 25 (Low)
- 131.222.247.51: Risk 0 (Clean)
- 131.222.247.176: Risk 25 (Low)
---
## Historical Observations (11 Total)
Recent activity indicates DNSBL listing activity (observed 2026-07-23). DNSSEC validation confirmed. No ownership changes or persistent malicious behavior detected. Threat observation count remains at zero.
---
## Recommended Actions
Status: Block Recommended
Firewall rules generated for deployment:
- iptables: `iptables -A INPUT -s 131.222.247.79 -j DROP`
- nftables: `nft add rule inet filter input ip saddr 131.222.247.79 drop`
- nginx: `deny 131.222.247.79;`
- pfSense: `131.222.247.79/32`
- Cloudflare WAF: Block with expression `ip.src eq 131.222.247.79`
- AWS WAF: Addresses `131.222.247.79/32`, Description: IPDebrief risk 40
---
## Analyst Notes
The IP lacks traditional threat signatures (no scans, exploits, or known campaigns) but carries DNSBL associations warranting blocking. Subnet environment remains benign with low-risk neighbors. Monitor for reputation changes; no persistent malicious behavior confirmed.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | IPv4 Center |
| ASN | AS216472 |
| Network Name | TR-HSPEED-20250608 |
| CIDR Block | 131.222.247.0/24 |
| RIR | ARIN |
| Country | TR |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🛡️ Public Network Snapshot
| Origin ASN | AS216472 |
| Network Prefix | 131.222.247.0/24 |
| Route mapping | Found |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 25% | 1 | 1 |
| routing | 0% | 0 | 0 |
| services | 0% | 0 | 0 |
| ownership | 25% | 1 | 2 |
| reputation | 25% | 1 | 1 |
| geolocation | 25% | 1 | 1 |
| Overall | 16% | 4 | 5 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-04 23:31:09 UTC |
| Last Seen | 2026-08-29 04:23:05 UTC |
| Profile Built | 2026-08-29 04:23:38 UTC |
| Data Freshness | Live |
| Signal Types | 14 |
| Total Observations | 16 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 131.222.247.79
Who owns the IP address 131.222.247.79?
131.222.247.79 is registered to IPv4 Center. The address falls within the 131.222.247.0/24 network block. Registration is held at ARIN.
Where is 131.222.247.79 located?
Geolocation data places 131.222.247.79 in Antakya, Hatay, Turkey. The local time zone is Europe/Istanbul. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 131.222.247.79 malicious or safe?
131.222.247.79 currently carries a low risk assessment, meaning no significant threat indicators have been observed. This assessment is generated from continuously collected signals and can change over time.