196.0.124.146📋 Copy

## Intelligence Briefing: IP 196.0.124.146/32

Classification: High Risk (Score: 80/100)

Date: 2026-06-25

Scope: Single IP Analysis with Network Context

---

Executive Summary

IP 196.0.124.146 presents a high-risk profile (80/100) with multiple blacklist listings and active threat signals. The IP is associated with Uganda Telecom (AS21491) and operates from Kampala, Uganda. No active services were detected, but the IP is firewalled with no open ports. Immediate monitoring and blocking are recommended.

---

Key Findings

Ownership & Network:

• ASN: 21491 (Uganda Telecom)
• Organization: ORG-UTL1-AFRINIC (Kevin Mugaya Francis)
• CIDR Block: 196.0.0.0/16
• Geolocation: Kampala, Uganda (UG)

Threat Profile:

• Risk Score: 80 (Critical)
• Blacklist Status: Listed on 4 of 8 DNSBL feeds
• Network Classification: Firewalled / No Services
• Operator Score: 0.1304 (Minimal)
• Route Stability: Unstable (0 route changes in 30 days, but flagged as unstable)

Behavioral Indicators:

• 18 total observations recorded
• Recent geolocation signals from Alienvault OTX confirming Kampala location
• Multiple blacklist categorizations with high-severity flags
• No active services, TLS certificates, or HTTP endpoints detected
• No known campaigns or certificate matches

---

Neighborhood Analysis (196.0.124.0/24)

The /24 subnet shows elevated abuse density (0.2) with mixed classification:

• Total Siblings: 6
• Threat Siblings: 3
• Risk Distribution: 1 High (80), 4 Medium (55), 0 Low

High-risk neighbor IPs requiring attention:

• 196.0.124.58 (Risk: 80)
• 196.0.124.2, 196.0.124.62, 196.0.124.130, 196.0.124.138 (Risk: 55)

---

Recommended Actions

Immediate:

1. Block at Network Perimeter: Implement blocking rules across all security controls

2. Increase Logging: Enable verbose logging for traffic from this IP and related subnet

3. Monitor Related IPs: Track 196.0.124.58 and other high-risk neighbors in the /24

Firewall Rules:

```

# iptables

iptables -A INPUT -s 196.0.124.146 -j DROP

# nftables

nft add rule inet filter input ip saddr 196.0.124.146 drop

# Cloudflare WAF

ip.src eq 196.0.124.146 → BLOCK

# AWS WAF

Addresses: 196.0.124.146/32 → BLOCK

```

---

Intelligence Notes

The IP shows persistent threat signals with multiple blacklist listings and unstable routing characteristics. While no active services were detected, the high risk score combined with neighborhood abuse density suggests potential for opportunistic abuse. The subnet's mixed classification indicates compromised infrastructure within the 196.0.124.0/24 block.

Priority: CRITICAL

Recommended Handling: Block immediately and monitor subnet activity

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.