196.190.220.199📋 Copy

# IP Intelligence Briefing: 196.190.220.199/32

Classification: HIGH RISK | Risk Score: 80/100

## Executive Summary

IP address 196.190.220.199/32 presents a high-risk threat profile with elevated abuse indicators. The address belongs to Ethio Telecom (ASN 24757) in Addis Ababa, Ethiopia, and exhibits concerning behavioral patterns including DNS blacklist listings and presence in a high-abuse-density subnet. Recommended action is to block traffic from this address at perimeter security controls.

## Network Classification & Ownership

• ASN: 24757 (Ethio Telecom)
• Organization: Nebiyate Belete (ORG-ETC2-AFRINIC)
• Network Block: 196.188.0.0/14
• Geolocation: Addis Ababa, Ethiopia (8.0°N, 38.0°E)
• Provider Classification: ISP infrastructure

## Risk Assessment

Current Risk Profile

• Risk Score: 80/100 (High Risk)
• Blacklist Status: Listed on 5 of 8 DNSBL feeds
• DNSBL Classification: High severity listings detected
• Threat Indicators: Multiple signal observations indicating malicious activity
• Route Stability: Unstable (isRouteStable: false)

Neighborhood Analysis

The IP resides in subnet 196.190.220.0/24 with elevated abuse characteristics:

• Abuse Density: 1 (High)
• Total Siblings: 2
• Threat Siblings: 2
• Neighbor 196.190.220.168: Risk score 80/100 (flagged)

## Behavioral Indicators

• Service Status: No open ports detected (Firewalled/No Services)
• DNS Resolution: No PTR records, no forward resolution
• TLS/Certificates: None present
• Campaign Correlation: No known campaign matches identified
• Tor/Proxy: Not identified as Tor exit node or proxy

## Historical Signal Activity

Observation history shows 18 recorded signals with recent activity (June 2026) including:

• Multiple DNS blacklist listings with high severity
• ASN confirmation for Ethio Telecom
• Risk signal accumulation across 6 dimensions
• Evidence of active threat monitoring

## Recommended Actions

Immediate: Block Traffic

Implement the following firewall rules across perimeter security infrastructure:

Monitoring Recommendations

• Increase logging verbosity for this IP
• Review recent activity logs for connection attempts
• Monitor for subnet-level activity from 196.190.220.0/24
• Correlate with neighbor IP 196.190.220.168 for coordinated activity

## Intelligence Notes

The IP demonstrates characteristics consistent with abuse infrastructure despite showing no active service ports. The combination of DNS blacklist presence, high-risk neighborhood classification, and route instability suggests this address is being used for malicious purposes. The subnet's abuse density of 1 indicates coordinated activity from related addresses. SOC teams should monitor for any changes in routing behavior or additional blacklist listings over the next 30 days.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.