197.244.59.22📋 Copy

IP Intelligence Briefing: 197.244.59.22/32

Executive Summary

IP address 197.244.59.22 is a single-homed endpoint registered to Ahmed Kooli under ASN 37705 (afrinic registry). The IP operates within the 197.244.0.0/17 block in Tunis, Tunisia, and presents a low-risk profile with a composite risk score of 25. No active threat indicators were identified during analysis.

Ownership and Registration

• Owner: Ahmed Kooli
• ASN: 37705
• Network Block: 197.244.0.0 - 197.244.127.255 (197.244.0.0/17)
• RIR: AFRINIC
• Registration Date: Not available in current data
• Abuse Contact: Not configured

Geolocation

• Country: Tunisia (TN)
• Region: Tunis Governorate
• City: Tunis
• Coordinates: 34.4739°N, 9.4613°E (AlienVault OTX source)
• Geo-Consensus: Verified across multiple sources

Network Classification

• Infrastructure Type: Firewalled / No Services
• Open Ports: None detected
• DNS Resolution: No PTR records or forward resolution
• Email Authentication: SPF/DMARC not configured (no hosted domains)
• Certificate Authority: None detected

Threat Assessment

• Risk Score: 25 (Low Risk)
• Abuse Confidence: Not available
• Blacklist Status: Clean (0 blacklists)
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Threat Feeds: No active indicators
• Known Campaigns: None identified

Control Plane Analysis

• BGP Prefix: 197.244.0.0/17
• Origin ASN: 37705
• Operator Score: 0.1304 (Minimal)
• Route Stability: Not stable (route changes observed)
• RPKI State: Not evaluated
• DNSSEC Valid: Yes
• DNSBL Listed: 1 of 8 potential lists

Observation History

Ten signal observations recorded, with most activity concentrated on 2026-07-30. Key observations include:

• Geolocation signals consistently place the IP in Tunis, Tunisia
• One signal flagged `has_threats: true` with 1 pulse match
• Service scanning detected closed ports across multiple common service ranges
• Confidence levels varied from 0.18 to 0.75 across signals

Subnet Neighborhood Analysis

• Subnet: 197.244.59.22/24
• Total Siblings: 0
• Abuse Density: 0 (no sibling abuse)
• Risk Distribution: High: 0, Medium: 0, Low: 0
• Active Threat Siblings: 0

Relationship Graph

Two relationship entries identified, both referencing the parent network block 197.244.0.0 - 197.244.127.255. No additional entity relationships (hostnames, organizations, certificates) were discovered.

Recommended Security Actions

No automated security actions were recommended due to the low-risk profile. Standard network segmentation and monitoring practices are sufficient. The IP does not warrant immediate blocking or allow-listing actions based on current risk assessment.

Intelligence Notes

The IP presents minimal threat characteristics with no active malicious indicators. The single threat-related signal in the observation history should be noted but does not elevate the overall risk posture. The IP appears to be a dormant or minimally active endpoint with no services exposed. Routine monitoring is recommended to track any changes in network behavior or risk indicators.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.