196.0.24.114📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target IP: 196.0.24.114/32

Date: 2026-06-25

Classification: Moderate Risk

---

## EXECUTIVE SUMMARY

IP 196.0.24.114 is a web server located in Kampala, Uganda, operating under AS21491 (uganda telecom). The IP carries a risk score of 55/100 (Moderate Risk) with no direct threat indicators in the current profile. However, the subnet exhibits 33% abuse density with one known malicious sibling IP.

---

## NETWORK OWNERSHIP & GEOLOCATION

• ASN: 21491 (uganda telecom)
• Organization: ORG-UTL1-AFRINIC / Kevin Mugaya Francis
• CIDR Block: 196.0.0.0/16
• Country: Uganda (UG)
• City: Kampala, Central Region
• Registration: AFRINIC registry

---

## THREAT POSTURE

• Risk Score: 55/100 (Moderate Risk)
• Blacklist Count: 0
• DNSBL Listed: 3/8 lists
• Abuse Confidence: Not assigned
• Campaign Likelihood: None detected
• Known Attacker Status: False
• Spam Source Status: False

---

## NETWORK CLASSIFICATION & SERVICES

• Service Purpose: Web Server
• Open Ports: 80/tcp (HTTP), 443/tcp (HTTPS)
• Server Software: lighttpd/1.4.39
• TLS Certificate: Not present
• Cloud/CDN/Proxy: Negative
• Tor Exit Node: Negative

---

## SUBNET ANALYSIS (196.0.24.0/24)

• Abuse Density: 0.3333 (33%)
• Classification: Mostly Clean
• Total Siblings: 3
• Active Siblings: 2
• Threat Siblings: 1

High-Risk Neighbors:

---

## OBSERVATION HISTORY

• Total Observations: 19 signals recorded
• Recent Activity: Signals observed as recently as 2026-06-25
• Signal Type 27 (2026-06-25): ASN AS21491 uganda telecom flagged with threats: true, pulse_count: 13
• Signal Type 13 (2026-06-13): Subnet abuse_density: 0.3333, classification: mostly_clean, inherited_risk: 2
• Persistence: No persistent malicious activity detected (threatPersistenceDays: 0)

---

## CONTROL PLANE DATA

• BGP Prefix: 196.0.0.0/16
• Origin ASN: 21491
• DNSSEC: Valid
• Route Stability: Unstable (isRouteStable: false)
• Route Changes (30d): 0
• IRR Consistency: Not evaluated

---

## RECOMMENDED ACTIONS

Monitoring

• Action: Increase logging verbosity and review recent activity from this IP
• Severity: High
• Reason: Elevated risk score (55/100)

Firewall Rules

---

## SOC ANALYST NOTES

1. Correlate with neighbors: The subnet contains one confirmed malicious IP (196.0.24.94) and another elevated-risk IP (196.0.24.238). Review traffic patterns from all three IPs for coordinated activity.

2. Monitor for escalation: Recent signal (2026-06-25) indicates active threat presence in the ASN.

3. DNS reputation: IP listed on 3 of 8 DNSBLs; investigate specific list sources if blocking impacts legitimate traffic.

4. Geolocation validation: GeoPlausible flag is false; verify actual location if traffic patterns suggest otherwise.

---

*Report generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.