196.189.152.12📋 Copy

# IP Intelligence Briefing: 196.189.152.12

## Executive Summary

IP address 196.189.152.12 is classified as Low Risk with a risk score of 0. The address is registered to Ethio Telecom (ASN 24757) within the 196.189.144.0/20 CIDR block allocated by AFRINIC. Despite low risk classification, the IP exhibits inconsistent geolocation data showing US (Boston, MA) versus the expected Ethiopian origin, and recent observations include blacklist listings requiring SOC monitoring.

## Ownership and Registration

• ASN: 24757 (Ethio Telecom)
• Organization: Ethio Telecom
• Network Range: 196.189.144.0 - 196.189.159.255
• CIDR Block: 196.189.144.0/20
• RIR: AFRINIC
• Network Role: Residential Endpoint
• Connection Type: Residential

## Geolocation Analysis

Geolocation data presents conflicting information:

• Reported Location: US, Massachusetts, Boston
• Expected Location: Ethiopia (based on ASN and network registration)
• Geo-Consensus: False (indicates low confidence in location data)
• Geo-Plausible: False

This discrepancy suggests the IP's geolocation metadata may be inaccurate or the data may be spoofed.

## Threat Assessment

• Risk Score: 0
• Blacklist Count: 1 (recent listing with high severity)
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Known Campaigns: None identified

## Historical Observations (13 total signals)

Recent observations from 2026-07-22 indicate:

• DNSSEC Validation: Valid on reverse DNS zone (12.152.189.196.in-addr.arpa)
• ASN Confirmation: 24757 (Ethio Telecom), prefix 196.189.152.0/24
• Blacklist Activity: Listed on 8 total lists with 1 active listing at high severity
• PTR Records: None present
• Forward Resolution: No DNS forward resolution

## Neighborhood Analysis (/24 Subnet: 196.189.152.0/24)

• Abuse Density: 0
• Neighbor Count: 4 active siblings
• Risk Distribution: 0 high-risk, 1 medium-risk, 2 low-risk

Sibling IPs:

## Network Services and DNS

• Open Ports: None detected
• TLS Certificates: None
• HTTP Services: None
• Hosted Domains: 0
• Email Authentication: No SPF or DMARC records
• DNS Records: No PTR records, no forward hostnames

## Control Plane and Routing

• Route Stability: False (indicates potential routing instability)
• Threat Observation Count: 0
• Is Persistently Malicious: False
• BGP Prefix: 196.189.152.0/24
• Transit Networks: Comcast, Hurricane Electric (HE)
• Traceroute: 29 hops, 15 timed out hops

## Security Recommendations

Based on the risk profile (risk score 0, no active threats), no immediate firewall or blocking actions are recommended. However, the following observations warrant SOC monitoring:

1. Monitor Blacklist Status: The IP was listed on 8 threat lists with high severity on 2026-07-22. Verify if this listing persists.

2. Geolocation Discrepancy: Investigate the US vs Ethiopia location mismatch as part of broader network reputation analysis.

3. Neighborhood Correlation: Monitor sibling IP 196.189.152.124 (risk score 40) which shows medium risk classification within the same /24 subnet.

## Conclusion

IP 196.189.152.12 represents a low-risk residential endpoint with no active malicious indicators. The primary concern is the geolocation inconsistency and recent blacklist activity. No immediate defensive action is required, but continued monitoring is advised for any changes in threat posture or geolocation data.

---

*Intel generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.