196.0.119.246📋 Copy

# IP Intelligence Briefing: 196.0.119.246/32

Classification: HIGH RISK | Risk Score: 70/100 | Date: 2026-07-23

## Executive Summary

Target IP 196.0.119.246 is classified as HIGH RISK with a risk score of 70/100. The IP is associated with organization ORG-UTL1-AFRINIC (Kevin Mugaya Francis), ASN 21491. While no active threat indicators or known campaigns were detected, the IP presents elevated risk requiring enhanced monitoring and defensive posture adjustments.

## Key Findings

Ownership & Registration

• Organization: Kevin Mugaya Francis
• ASN: 21491
• RIR: AFRINIC
• CIDR Block: 196.0.0.0/16
• Contact: abuse email not provided

Geolocation & Routing

• Reported Location: London, Central Region, GB (geo consensus: false)
• Alternative Location: Kampala, Uganda (UG) per MaxMind Geolite2
• Route Stability: Not stable (route changes observed)
• BGP Prefix: 196.0.0.0/16
• Traceroute: 29 hops via Comcast and Cogent transit networks

Network Services

• Open Ports: None detected
• Service Status: Firewalled / No Services
• TLS/HTTP: No certificates or web services detected
• DNS: No forward resolution, no PTR records

Threat Indicators

• Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• DNSBL Listings: 4 out of 8 total lists
• Campaign Correlation: None detected

Neighborhood Analysis (196.0.119.0/24)

• Total Siblings: 4
• Abuse Density: 0.25 (elevated)
• Risk Distribution: High (1), Medium (3), Low (0)
• High-Risk Neighbors: 196.0.119.246 (70), 196.0.119.218 (70), 196.0.119.250 (80)

Historical Observations

• Total Signals: 11 observations
• Ownership Persistence: Stable (no changes)
• Threat Persistence: 0 days
• Notable Signal Variance: Geolocation inconsistencies between Kampala, UG and London, GB across observation timestamps

## Recommended Actions

Immediate

1. Block at Network Perimeter: Implement firewall rules to drop traffic from this IP

2. Enhanced Logging: Increase logging verbosity for any traffic from this IP range

3. Monitor Neighboring IPs: Investigate 196.0.119.2, 196.0.119.218, and 196.0.119.250 for potential related activity

Technical Controls

```bash

# iptables

iptables -A INPUT -s 196.0.119.246 -j DROP

# nftables

nft add rule inet filter input ip saddr 196.0.119.246 drop

# NGINX

deny 196.0.119.246;

# Cloudflare WAF

# Block 196.0.119.246 — IPDebrief risk score 70

```

Strategic Considerations

• The subnet exhibits elevated abuse density (0.25) with three additional high-risk neighbors
• Geolocation inconsistencies may indicate misconfigured routing or potential spoofing
• No active threat indicators present, but the risk score warrants defensive blocking
• Review historical data for any escalation patterns in threat signals

Analyst Notes: While no active malicious activity was detected, the combination of elevated risk score, multiple DNSBL listings, and high-risk neighboring IPs suggests this IP should be treated as suspicious traffic requiring monitoring and potential blocking.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.