197.218.110.252📋 Copy

# Threat Intelligence Briefing: 197.218.110.252/32

Classification: Low Risk

Date of Analysis: 2026-07-30

## Executive Summary

IP address 197.218.110.252/32 was assessed as Low Risk with a risk score of 15. No active threat indicators, blacklisting, or malicious campaigns were identified. The IP belongs to NGUYEN TRUNG HAU (ASN 37342) within the 197.218.64.0/18 block, registered under AfriNIC with operations in Nampula, Mozambique.

## Ownership and Geolocation

• Organization: NGUYEN TRUNG HAU
• ASN: 37342
• CIDR Block: 197.218.64.0/18
• Geolocation: Nampula, Mozambique (MZ)
• RIR: AfriNIC
• Network Classification: Firewalled / No Services

## Network Behavior and Services

No open ports or active services were detected on the target IP. Reverse DNS resolves to dynamic-adsl.movitel.co.mz, indicating association with the Mozambican telecommunications provider Movitel. Forward DNS confirmation failed, and the IP does not host any public domains.

## Threat Assessment

• Risk Score: 15 (Low Risk)
• Abuse Confidence Score: Not applicable
• Blacklist Status: Not listed on any threat feeds
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Threat Indicators: None identified
• Associated Campaigns: None detected

## Historical Analysis

Fourteen observations recorded over the monitoring period showed consistent low-risk signals. Ownership changes remained at zero, and threat persistence days were recorded as zero. No persistent malicious activity was observed. The subnet classification remained "clean" throughout the observation window, with abuse density of 0.

## Neighborhood Analysis

The /24 subnet (197.218.110.0/24) contains one sibling IP address with no active or threat-related siblings. Subnet abuse density is 0, and the neighborhood classification is "clean." No high or medium-risk neighbors were detected.

## Relationships

The IP maintains DNS associations with the hostname dynamic-adsl.movitel.co.mz. Network-level relationships confirm association with the 197.218.64.0 - 197.218.127.255 block. No certificate-based or organizational cross-references were identified.

## Recommended Actions

• Firewall Rule: No blocking required based on current risk profile
• Monitoring: Continue passive observation; no immediate action recommended
• Context: This IP appears to be a residential or dynamically assigned address used for legitimate services. No defensive hardening required at this time.

## Conclusion

197.218.110.252/32 presents a low-risk profile with no evidence of malicious activity. The IP is associated with a Mozambican ISP and shows consistent benign behavior across all threat intelligence feeds. No escalation or blocking actions are warranted.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.