197.164.26.38📋 Copy

# IP Intelligence Briefing: 197.164.26.38/32

Classification: Moderate Risk (Score: 50) | Jurisdiction: Egypt (EG) | Date Generated: 2026-07-31

---

## Executive Summary

IP 197.164.26.38 is associated with AS24863 (Sherif Ghareeb) in the AFRINIC region. The IP presents a moderate risk profile with a reputation score of 50 and is currently listed on 2 of 8 DNSBL feeds. No active services, open ports, or known attack indicators were observed. The address is geolocated to the Cairo region with a confidence radius of 600km.

---

## Network Ownership & Control Plane

• ASN: 24863
• Organization: Sherif Ghareeb
• Network Block: 197.164.0.0/18 (197.164.0.0 - 197.164.63.255)
• BGP Prefix: 197.164.24.0/22
• Route Stability: Unstable (route changes detected)
• RPKI State: Not validated
• IRR Consistency: Not assessed

---

## Threat Indicators

• Risk Score: 50 (Moderate)
• Blacklist Count: 2 active listings
• DNSBL Listings: 2 of 8 total feeds
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Affiliations: None detected
• Abuse Confidence Score: Not applicable

---

## Service & Network Role Assessment

• Service Status: Firewalled / No Services
• Open Ports: None detected
• TLS Certificate: None
• HTTP Service: None
• Infrastructure Type: Not cloud/CDN/VPN/proxy
• Connection Type: Not residential/mobile

---

## Neighborhood Analysis (197.164.26.0/24)

• Abuse Density: 0%
• Classification: Clean
• Active Siblings: 0
• Threat Siblings: 0
• High/Medium/Low Risk Neighbors: 0/0/0

---

## Temporal Analysis

• Observation Count: 14 historical signals
• Last Observed: 2026-07-31 02:08:52 UTC
• Threat Persistence: 0 days
• Ownership Changes: 0
• Is Persistently Malicious: No

---

## Observation History (Recent)

Recent probing confirmed Egyptian geolocation with coordinates 26.82°N, 30.8°E (Cairo area, 3,194km from probe location). ICMP validation failed due to blocking. Service scanning returned no open ports. ASN and organizational registration were validated with 95% confidence.

---

## Relationship Graph

• Same Network: 197.164.0.0 - 197.164.63.255 (2 entries)
• External Relationships: None detected
• Hostnames/Certificates: None

---

## Recommended Security Actions

Given the moderate risk score and DNSBL listings, the following firewall rules are recommended:

```bash

# iptables

iptables -A INPUT -s 197.164.26.38 -j DROP

# nftables

nft add rule inet filter input ip saddr 197.164.26.38 drop

# nginx

deny 197.164.26.38;

# pfSense

197.164.26.38/32

# Cloudflare WAF

Expression: ip.src eq 197.164.26.38 (Action: block)

# AWS WAF

Address: 197.164.26.38/32

```

---

## Analyst Notes

While the immediate subnet shows clean classification with zero abuse density, the IP's moderate risk score and dual DNSBL listings suggest potential reputation issues. The route instability (BGP prefix 197.164.24.0/22 not route-stable) warrants monitoring for infrastructure changes. Recommend continued observation and correlation with any incoming traffic from this address or its /24 neighbors.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.