197.248.89.127
# IP Intelligence Briefing: 197.248.89.127
## Executive Summary
IP address 197.248.89.127 presents moderate risk with no active threat indicators. The address is associated with Safaricom Business infrastructure, shows no open services, and maintains a clean neighborhood classification. Recommend monitoring for DNSBL listing persistence.
## Profile Overview
- Risk Score: 50 (Moderate Risk)
- ASN: 37061 (Domain Admin)
- Network: 197.248.64.0/18 (afrinic)
- Organization: Domain Admin
- Registration: 197.248.64.0 - 197.248.127.255
- Network Role: Firewalled / No Services
- Abuse Confidence: Not applicable
## Geolocation Analysis
- Reported Location: Nairobi County, Kenya (KE) with London city designation in some records
- Distance from Probe: 6,606.3 km from origin
- Geo Validation: Plausible (5 probe points, avg RTT 246.2ms)
- Note: Geographic data shows inconsistency between KE/GB designations
## Threat Indicators
- Blacklist Status: 2 listings out of 8 total DNSBL checks
- Known Attacker: No
- Spam Source: No
- Tor Exit Node: No
- Campaign Matches: 0
- Known Malicious Activity: None detected
## DNS and Hostname Associations
- PTR Record: 197-248-89-127.safaricombusiness.co.ke
- Forward Resolution: Unconfirmed
- Email Authentication: No SPF/DMARC records configured
- Associated Domain: safaricombusiness.co.ke (Safaricom business services)
## Network Neighborhood Analysis
- Subnet: 197.248.89.127/24
- Abuse Density: 0% (Clean classification)
- Threat Siblings: 0
- Active Siblings: 0
- Neighbor Risk Distribution: All low/zero
## Historical Observation (16 signals)
- Ownership Changes: 0
- Threat Persistence: 0 days
- Persistently Malicious: No
- Recent Geo Data: Nairobi, Kenya with afrinic RIR registration
- Control Plane: Route stability flag inconsistent (isRouteStable: false)
## Service Analysis
- Open Ports: None
- HTTPS/TLS: No certificates detected
- HTTP Services: No active HTTP title or banner
- Infrastructure Type: No CDN/Cloud/Proxy/Vpn indicators
## Recommended Actions
1. Monitor DNSBL persistence: Two blacklist listings may indicate prior reputation issues
2. Validate geolocation: Investigate KE/GB discrepancy for potential spoofing
3. Review email authentication: Missing SPF/DMARC records for associated domain
4. No immediate blocking required: No active threat indicators or open services
## Conclusion
This IP is part of Safaricom business infrastructure with moderate risk scoring. The absence of open services, clean neighborhood classification, and lack of known attacker indicators support classification as non-malicious. The primary concern is DNSBL listing persistence requiring continued monitoring. No immediate defensive action required beyond standard observation.
---
*Generated: 2026-07-26 | Intelligence Source: IPDebrief Platform*
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Domain Admin |
| ASN | AS37061 |
| Network Name | 197.248.64.0 - 197.248.127.255 |
| CIDR Block | 197.248.64.0/18 |
| RIR | AFRINIC |
| Country | KE |
| Abuse Contact | — |
🌐 DNS Intelligence
| PTR | 197-248-89-127.safaricombusiness.co.ke |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | 197-248-89-127.safaricombusiness.co.ke |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | 0/6 domains |
| DMARC | 3/6 domains |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
| Domains Checked | 6 domains |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 443 | https | tcp | — |
| 22 | ssh | tcp | Banner detected |
| Closed Ports | 25, 80, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | Web server detected |
| HTTP Title | — |
🔐 TLS Certificate
CN=premierairline.3cx.sc was found on this IP. This may indicate a previously hosted website, a decommissioned service, or stale infrastructure.| SANs | premierairline.3cx.sc |
| Valid From | 2026-06-05T22:23:06+00:00 |
| Valid Until | 2026-09-03T22:23:05+00:00 (expired) |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_256_GCM_SHA384 |
| Signature Algorithm | sha256RSA |
| Validity Period | 89 days |
🛡️ Public Network Snapshot
| Origin ASN | AS37061 |
| Network Prefix | 197.248.64.0/18 |
| Route mapping | Found |
| HSTS | Enabled |
| CSP | Enabled |
| HTTP/2 | Enabled |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 25% | 2 | 3 |
| routing | 8% | 1 | 1 |
| services | 20% | 2 | 3 |
| ownership | 12% | 2 | 2 |
| reputation | 8% | 1 | 2 |
| geolocation | 12% | 2 | 2 |
| Overall | 14% | 10 | 13 |
| Data Coherence | Mixed Signals (65%) — 2 contradiction(s) |
| Attribution | Low (35%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
⚠ Geo sources disagree on country: KE, GB
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-11 08:22:35 UTC |
| Last Seen | 2026-09-14 05:07:52 UTC |
| Profile Built | 2026-09-12 22:05:18 UTC |
| Data Freshness | Live |
| Signal Types | 20 |
| Total Observations | 32 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 197.248.89.127
Who owns the IP address 197.248.89.127?
197.248.89.127 is registered to Domain Admin. The address falls within the 197.248.64.0/18 network block. Registration is held at AFRINIC.
Where is 197.248.89.127 located?
Geolocation data places 197.248.89.127 in London, Nairobi County, United Kingdom. The local time zone is Europe/London. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 197.248.89.127 malicious or safe?
197.248.89.127 currently carries a moderate risk assessment, meaning some indicators warrant caution, but the evidence is mixed. This assessment is generated from continuously collected signals and can change over time.
What is the hostname for 197.248.89.127?
The reverse DNS (PTR) record for 197.248.89.127 is 197-248-89-127.safaricombusiness.co.ke. This hostname is not forward-confirmed, so it should be treated as a weak signal.
What ports are open on 197.248.89.127?
Responsive ports observed on 197.248.89.127 include 443, 22. Port visibility reflects the most recent scan and may change as the host's configuration or firewall rules change.