196.0.122.122📋 Copy

## Intelligence Briefing: 196.0.122.122/32

Classification: HIGH RISK THREAT INDICATOR

Date: 2026-06-23

Executive Summary

IP address 196.0.122.122 is classified as high risk (score: 80/100) with elevated threat indicators. The address is associated with ASN 21491 (Kevin Mugaya Francis, ORG-UTL1-AFRINIC) and registered under the African Internet Registry (AFRINIC). Geolocation data indicates placement in Kampala, Uganda, Central Region.

Threat Profile

• Risk Score: 80/100 (High Risk)
• Threat Indicators: Listed on 8 DNS blacklist sources with 4 active listings showing high severity
• Service Role: Web Server (HTTP/HTTPS ports 80/443, SSH port 22)
• Server Banner: lighttpd/1.4.39
• Control Plane: BGP prefix 196.0.0.0/16, route stability: unstable, operator score: 0.1304 (Minimal)
• Reputation: No known campaigns, no Tor exit node activity, not flagged as known attacker or spam source

Network Context

The IP resides in subnet 196.0.122.0/24, classified as high abuse density. Neighborhood analysis identified 9 sibling IPs with the following risk distribution:

• High Risk: 2 (196.0.122.22, 196.0.122.242)
• Medium Risk: 7
• Low Risk: 0

Subnet abuse density: 0.222 (6 threat-sibling IPs out of 10 active siblings).

Historical Observations

Sixteen observations recorded over the monitoring period. Recent signals (2026-06-23) show:

• Multiple blacklist listings with high severity ratings
• Connection failures on HTTPS probes
• Operator score of 0 (Minimal)
• Threat observation count: 1

Related Entities

All relationship data points to ORG-UTL1-AFRINIC (same network classification). No correlated certificates or hostnames detected.

Recommended Actions

Immediate:

• Block 196.0.122.122/32 at perimeter firewall
• Increase logging verbosity for traffic analysis
• Monitor for associated subnet activity (196.0.122.0/24)

Firewall Rules:

• iptables: `iptables -A INPUT -s 196.0.122.122 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 196.0.122.122 drop`
• Cloudflare WAF: Block IP 196.0.122.122 (risk score 80)
• AWS WAF: Add 196.0.122.122/32 to blocklist

Assessment

The IP demonstrates elevated risk characteristics with DNS blacklist presence and unstable routing. The high-abuse subnet context suggests potential for coordinated malicious activity. Recommend blocking and monitoring for correlated traffic patterns from associated subnet addresses.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.