196.51.187.106📋 Copy

## Intelligence Briefing: 196.51.187.106

Executive Summary

IP address 196.51.187.106 presents a Low Risk profile (Risk Score: 25) with no active threat indicators. The address is associated with South Africa (ZA), classified as "clean" with minimal neighborhood abuse density. No malicious activity or service enumeration observed.

Ownership & Network Classification

• Organization: ORG-ECSC1-AFRINIC (Afrinic RIR)
• NetName: ORG-ECSC1-AFRINIC
• ASN: 400463
• CIDR Block: 196.51.0.0/16
• Registration: Afrinic registry
• Network Role: Firewalled / No Services

Geolocation Data

• Country: South Africa (ZA)
• Timezone: Africa/Johannesburg
• Coordinates: -30.56, 22.94
• Accuracy Radius: 800 km
• Geo Confidence: 0.52 (moderate)
• GeoConsensus: True (1 source)

Threat Intelligence Assessment

• Risk Score: 25 (Low Risk)
• Abuse Confidence Score: Not available
• Blacklist Status: 0 direct blacklists
• DNSBL Listings: 1 of 8 total lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Threat Indicators: None

Network Neighborhood Analysis

• Subnet: 196.51.187.106/24
• Abuse Density: 0% (clean classification)
• Threat Siblings: 0
• Active Siblings: 0
• Inherited Risk: 0
• Total Siblings in Subnet: 1

Service & Port Scan Results

• Open Ports: None detected
• TLS Certificate: None
• HTTP Service: None
• DNS Resolution: No PTR records, no forward resolution
• Email Auth: SPF/DMARC not configured (no hosted domains)

Control Plane & Routing

• BGP Prefix: 196.51.128.0/17
• Origin ASN: 400463
• Route Stability: False
• RPKI State: Not evaluated
• IRR Consistency: Not evaluated
• Route Changes (30d): 0

Traceroute Analysis

• Total Hops: 22
• First Hop RTT: 0.3 ms
• Last Hop RTT: 80.8 ms
• Timed Out Hops: 8
• Transit Networks: Comcast, Zayo

Historical Signal Observations

• Total Observations: 14
• Recent Classification: Clean (2026-07-30)
• Abuse Density Trend: Stable at 0
• Threat Persistence: 0 days
• Ownership Changes: 0
• Signal Types: Subnet analysis, traceroute, geolocation inference, ownership verification

Relationship Graph

• Primary Associations: ORG-ECSC1-AFRINIC (5 relationships)
• No External Correlations: No links to hostnames, certificates, or other organizations detected

Recommended Actions

No immediate blocking required. The IP address presents minimal threat characteristics:

1. Monitor: Continue routine monitoring; no active threats detected

2. Allow Traffic: Standard network access permitted

3. Geolocation Verification: Consider enhanced geolocation validation due to 800km accuracy radius

4. DNSBL Review: Investigate single DNSBL listing for context if needed

SOC Analyst Notes

This IP represents a low-risk, passive network asset with no observable malicious activity. The South African origin and organizational attribution (ORG-ECSC1-AFRINIC) align with legitimate infrastructure patterns. The single DNSBL listing warrants periodic review but does not indicate active abuse. No firewall rules or blocking measures recommended at this time.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.