196.203.63.80📋 Copy

# INTELLIGENCE BRIEFING: 196.203.63.80/32

Classification: LOW RISK

Risk Score: 25/100

Date of Analysis: 2026-07-28

## EXECUTIVE SUMMARY

IP address 196.203.63.80 is registered to ATI - Agence Tunisienne Internet (ASN 37693) under AFRINIC. The IP presents a low risk profile with limited threat indicators. Current observation data indicates firewalled status with no active services. Geolocation data shows conflicting signals between Tunisian (TN) and US (New York) sources, requiring further validation.

## OWNERSHIP AND ATTRIBUTION

The IP belongs to a Tunisian telecommunications provider with no known abuse history. Network classification indicates firewalled infrastructure with no exposed services.

## GEOLOCATION ANALYSIS

Conflicting geolocation signals observed across multiple data sources:

• Primary Signal: New York, US (US-NY)
• Secondary Signal: Tunis, TN (AFRINIC registration data)
• GeoValidation Status: Inconsistent (geoConsensus: false)

This discrepancy warrants monitoring. The AFRINIC registration strongly indicates Tunisian ownership, while the US signal may represent routing anomalies or CDN placement.

## THREAT INTELLIGENCE

Control plane analysis reveals 1 DNSBL listing with high severity among 8 total lists. RPKI state is null, and the route shows instability (isRouteStable: false).

## NETWORK BEHAVIOR

• Service Status: Firewalled / No Services
• Open Ports: None detected
• TLS Certificates: None
• HTTP Services: None
• DNS Records: 0 forward confirmations
• PTR Hostnames: None

No open services or banner information available. The IP appears to be used for upstream infrastructure rather than direct host services.

## TEMPORAL ANALYSIS

• Threat Observations: 1
• Threat Persistence: Not persistently malicious
• Ownership Changes: 0 (stable)
• Average Ownership Days: Unavailable
• Observation Count: 13 total signals

Recent history shows 13 observations with consistent ownership and no significant threat pattern changes over time.

## NEIGHBORHOOD ANALYSIS

Subnet: 196.203.63.0/24

• Total Siblings: 0
• Active Siblings: 0
• Threat Siblings: 0
• Abuse Density: 0%

No neighboring IPs detected in the /24 subnet. The absence of sibling activity suggests isolated infrastructure rather than a cluster.

## RELATIONSHIP GRAPH

• Same Network: ORG-ATIA2-AFRINIC
• Related Hostnames: None
• Organizations: ATI - Agence Tunisienne Internet
• Certificates: None

Limited relationship data with only the originating network organization identified.

## RECOMMENDED ACTIONS

## SOC ANALYST NOTES

1. Low Immediate Threat: The IP maintains a low risk score (25) with no active threat indicators requiring immediate action.

2. Geolocation Discrepancy: The conflict between US and Tunisian geolocation data should be flagged for validation. This may indicate:

- Misconfigured routing

- CDN edge node placement

- Data source inconsistency

3. DNSBL Listing: One high-severity DNSBL listing exists. Review the specific blacklist and determine if it relates to the IP or associated infrastructure.

4. Route Instability: The BGP prefix shows route instability. Monitor for potential network renumbering or infrastructure changes.

5. No Active Services: With no open ports or services, the IP does not pose immediate exploitation risk.

---

Intelligence Generated: 2026-07-28

Data Sources: IPDebrief Intelligence Platform

Confidence Level: Medium (geolocation inconsistency)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.