193.95.2.247📋 Copy

# IP Intelligence Briefing: 193.95.2.247

## Executive Summary

Intellective assessment identifies 193.95.2.247 as a low-risk network endpoint (risk score: 25) with conflicting geolocation data and limited threat indicators. The IP belongs to ATI - Agence Tunisienne Internet (AS31245) and presents minimal operational activity. No immediate blocking is warranted, but monitoring is recommended due to geolocation inconsistencies.

---

## Network Ownership & Classification

---

## Geolocation Intelligence

Discrepancy Detected: Profile indicates US (New York) while recent signals show Tunisia (TN). This inconsistency warrants attention.

---

## Threat Indicators

• Risk Score: 25 (Low Risk)
• DNSBL Listings: 1 of 8 total lists (high severity)
• Threat Feeds: 7 pulses detected
• Abuse Confidence: Not scored
• Tor/Proxy/Vpn: Negative across all categories
• Known Attacker: False
• Spam Source: False

---

## Neighborhood Analysis (193.95.2.0/24)

Neighbor IP: 193.95.2.161 (risk score: null)

---

## Historical Observations (11 Total)

Most recent activity recorded: 2026-07-29T22:29:09

Key Historical Signals:

• Multiple threat feed pulses (7 total)
• DNSBL listings across 8 lists
• Operator score: 0.1304 (Minimal)
• Ownership changes: 0
• Threat persistence days: 0
• Not persistently malicious

---

## Network Control Plane

• Origin ASN: AS31245
• BGP Prefix: 193.95.2.0/24
• Route Stable: False
• MOAS: False
• DNSSEC Valid: True
• IRP Consistency: N/A
• Route Changes (30d): 0

---

## Recommended Actions

---

## Intelligence Narrative

IP 193.95.2.247 operates within the ATI - Agence Tunisienne Internet network block (193.95.2.0/24). Despite a low risk score of 25, the IP presents notable intelligence gaps: geolocation data conflicts between US and Tunisia, and the subnet shows false route stability. The single DNSBL listing with high severity and 7 threat feed pulses suggest intermittent activity that has not yet escalated. No open services or active ports detected on the endpoint.

The neighborhood (193.95.2.0/24) exhibits zero abuse density with one sibling IP (193.95.2.161) of unknown status. This suggests the IP is not part of a coordinated attack infrastructure.

Recommended SOC Action: Maintain current monitoring posture. The low risk score combined with minimal neighborhood activity supports continued passive observation. The geolocation discrepancy should be flagged for further validation against other threat intel sources. No immediate blocking or firewall rules are warranted based on current data.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.