197.1.66.252📋 Copy

## IP Intelligence Briefing: 197.1.66.252/32

Executive Summary

IP address 197.1.66.252 is associated with ATI - Agence Tunisienne Internet (ASN 37705) in Tunis, Tunisia. The IP presents a moderate risk profile with a risk score of 40. No active threat indicators, open services, or known malicious activity were detected during profiling.

Risk Assessment

• Risk Score: 40 (Moderate Risk)
• Provider Risk: Not applicable
• Abuse Confidence: Not scored
• Blacklist Presence: 0 confirmed blacklists
• DNSBL Listings: 2 of 8 total lists
• Campaign Association: None detected
• Threat Persistence: Not persistently malicious

Geolocation & Infrastructure

• Country: Tunisia (TN)
• Region: Tunis Governorate
• City: Tunis
• Coordinates: 36.82°N, 10.17°E
• ASN: 37705 (ORG-ATIA2-AFRINIC)
• CIDR Block: 197.0.0.0/15
• BGP Prefix: 197.1.0.0/17
• Ownership: ATI - Agence Tunisienne Internet

Network Classification

• Infrastructure Type: Firewalled / No Services
• Open Ports: None detected
• DNS Status: No reverse DNS records
• Email Authentication: SPF and DMARC not configured
• DNSSEC: Valid
• Cloud/CDN/Proxy: Not identified

Neighborhood Analysis

The /24 subnet (197.1.66.252/24) shows:

• Abuse Density: 0 (clean)
• Threat Siblings: 0
• Active Siblings: 1
• Classification: Clean

Historical Signals

12 observations recorded. Most recent signal (2026-07-30) indicates:

• No ownership changes
• Subnet classification remains clean
• No banner matches or campaign correlations
• Operator score: 0.1304 (Minimal)

Recommended Security Actions

Based on risk profile, the following firewall rules are recommended:

iptables:

```

iptables -A INPUT -s 197.1.66.252 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 197.1.66.252 drop

```

nginx:

```

deny 197.1.66.252;

```

pfSense:

```

197.1.66.252/32

```

Cloudflare WAF:

```json

{

"description": "Block 197.1.66.252 — IPDebrief risk score 40",

"action": "block",

"filter": {"expression": "ip.src eq 197.1.66.252"}

}

```

AWS WAF:

```json

{

"Addresses": ["197.1.66.252/32"],

"Description": "IPDebrief risk 40"

}

```

Intelligence Notes

• No active threat indicators detected
• IP is associated with Tunisian ISP ATI
• No open services or banners observed
• DNSBL presence suggests prior reputation issues on some lists
• Subnet neighborhood appears clean with no correlated threats
• Route stability is flagged as false; monitor for routing changes

Recommended Action: Apply recommended firewall rules with caution. The moderate risk score warrants defensive blocking, but the lack of active threat indicators suggests this may be precautionary rather than reactive to confirmed malicious activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.