197.248.141.113
# IP Intelligence Briefing: 197.248.141.113/32
## Executive Summary
IP address 197.248.141.113 presents as a low-risk endpoint with no observed malicious activity. The address belongs to the 197.248.128.0/18 block and is associated with Safaricom Business services infrastructure. No actionable threats identified; recommend standard monitoring procedures.
## Risk Profile
- Overall Risk Score: 0 (Low Risk)
- Provider/Authority Scores: 0/0
- Abuse Confidence: None detected
- Blacklist Status: Not listed (0 DNSBL entries)
- Campaign Association: No known campaigns correlated
- Tor/Proxy/VPN: Not classified as any of these services
## Ownership and Registration
- ASN: 37061 (Domain Admin)
- Organization: Domain Admin
- Network Block: 197.248.128.0 - 197.248.191.255
- RIR: AFRINIC
- Country Registration: GB (geolocation data shows inconsistency with .co.ke domain)
## Network Behavior and Services
- Open Ports: None detected
- Service Classification: Firewalled / No Services
- Cloud/CDN/Hosting: Not classified
- Mobile/Residential: Not classified
- DNS PTR: 197-248-141-113.safaricombusiness.co.ke
- Forward Resolution: Confirmed to safaricombusiness.co.ke domain
## Geographic Indicators
- Reported Location: Nairobi County, London (GB)
- Geolocation Confidence: Plausible
- Distance from Probe: ~6,606 km
- Average RTT: 221.6 ms
- Note: Geographic data shows inconsistency between GB country code and .co.ke Kenya domain extension
## Historical Observations
- Total Observations: 18
- Recent Classification: Clean
- Threat Persistence: 0 days
- Ownership Changes: None
- Traceroute: 13 hops (last hop 264.1ms)
- Route Stability: False (route changes observed in 30-day window)
## Neighborhood Analysis
- Subnet: 197.248.141.113/24
- Active Siblings: 0
- Threat Siblings: 0
- Abuse Density: 0
- Classification: Clean
## Relationship Graph
- Same Network: 197.248.128.0/18 (multiple associations)
- DNS Associations: 197-248-141-113.safaricombusiness.co.ke (4 relationships)
- Total Relationships: 8
## Recommended Actions
- Firewall Rules: No specific blocking required; standard monitoring recommended
- WAF Configuration: No specific rules recommended
- Threat Hunting: No immediate indicators requiring investigation
## Conclusion
The IP address 197.248.141.113 exhibits normal operational characteristics consistent with business infrastructure. The association with Safaricom Business domain and absence of threat indicators suggest legitimate use. No blocking or restrictive actions recommended. Standard SOC monitoring protocols apply.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Domain Admin |
| ASN | AS37061 |
| Network Name | 197.248.128.0 - 197.248.191.255 |
| CIDR Block | 197.248.128.0/18 |
| RIR | AFRINIC |
| Country | KE |
| Abuse Contact | — |
🌐 DNS Intelligence
| PTR | 197-248-141-113.safaricombusiness.co.ke |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | 197-248-141-113.safaricombusiness.co.ke |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 443 | https | tcp | — |
| 22 | ssh | tcp | Banner detected |
| 8443 | https-alt | tcp | — |
| Closed Ports | 25, 80, 3389, 8080 (3 open / 7 scanned) | ||
| Server | Web server detected |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | 2015-08-01T00:00:00+00:00 |
| Valid Until | 2036-12-31T23:59:59+00:00 |
| TLS Protocol | Tls12 |
| Cipher Suite | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 |
| Signature Algorithm | sha256RSA |
| Validity Period | 7823 days |
🛡️ Public Network Snapshot
| Origin ASN | AS37061 |
| Network Prefix | 197.248.128.0/18 |
| Route mapping | Found |
| HSTS | Enabled |
| CSP | Not detected |
| HTTP/2 | Not detected |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 30% | 2 | 5 |
| routing | 8% | 1 | 1 |
| services | 17% | 2 | 3 |
| ownership | 25% | 2 | 3 |
| reputation | 20% | 1 | 3 |
| geolocation | 25% | 2 | 3 |
| Overall | 21% | 10 | 18 |
| Data Coherence | Mixed Signals (68%) — 2 contradiction(s) |
| Attribution | Low (35%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
⚠ TLS certificate claims NA but primary geo says GB
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-12 14:58:59 UTC |
| Last Seen | 2026-09-04 18:17:48 UTC |
| Profile Built | 2026-09-04 18:27:39 UTC |
| Data Freshness | Live |
| Signal Types | 24 |
| Total Observations | 34 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 197.248.141.113
Who owns the IP address 197.248.141.113?
197.248.141.113 is registered to Domain Admin. The address falls within the 197.248.128.0/18 network block. Registration is held at AFRINIC.
Where is 197.248.141.113 located?
Geolocation data places 197.248.141.113 in London, Nairobi County, United Kingdom. The local time zone is Europe/London. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 197.248.141.113 malicious or safe?
197.248.141.113 currently carries a low risk assessment, meaning no significant threat indicators have been observed. This assessment is generated from continuously collected signals and can change over time.
What is the hostname for 197.248.141.113?
The reverse DNS (PTR) record for 197.248.141.113 is 197-248-141-113.safaricombusiness.co.ke. This hostname is not forward-confirmed, so it should be treated as a weak signal.
What ports are open on 197.248.141.113?
Responsive ports observed on 197.248.141.113 include 443, 22, 8443. Port visibility reflects the most recent scan and may change as the host's configuration or firewall rules change.