5.196.190.161📋 Copy

## IP Intelligence Briefing: 5.196.190.161

Date: 2026-06-20

Status: Active Threat Indicator

Risk Classification: Moderate Risk (55/100)

Executive Summary

IP address 5.196.190.161 is a French cloud infrastructure endpoint operated by OVH (ASN 16276) with elevated risk indicators. The IP is associated with the domain nobushige.ninja and has been observed on 3 of 8 DNSBL feeds. While the subnet (5.196.190.0/24) shows low abuse density (1/24), the specific endpoint warrants defensive monitoring.

Technical Profile

Threat Indicators

• DNSBL Listings: 3 confirmed blacklist entries across 8 total lists
• Operator Score: 0.1304 (Minimal risk classification)
• Route Stability: False (dynamic routing patterns detected)
• Threat Persistence: 0 days (no persistent malicious activity observed)
• Campaign Correlation: 0 matches in known threat campaigns

Network Neighborhood Analysis

• Subnet: 5.196.190.0/24
• Abuse Density: 1 (low density classification)
• Threat Siblings: 1 identified within subnet
• Active Siblings: 0
• Classification: Mostly clean

Historical Observations (18 signals)

Recent monitoring (2026-06-20) confirms consistent cloud hosting classification. Historical data from 2026-06-15 indicates the subnet was classified as "mostly_clean" with 1 threat sibling. No significant risk escalation detected over observation period.

Recommended Actions

Immediate:

• Implement firewall blocking per risk score (55/100)
• Increase logging verbosity for this IP
• Review recent activity logs for this address

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 5.196.190.161 -j DROP

# nftables

nft add rule inet filter input ip saddr 5.196.190.161 drop

# Cloudflare WAF

Expression: ip.src eq 5.196.190.161 (Block)

# AWS WAF

Addresses: 5.196.190.161/32 (Block)

```

Intelligence Assessment

This IP represents a moderate-risk hosting infrastructure endpoint with no confirmed malicious activity but elevated threat indicators. The association with nobushige.ninja and presence on multiple DNSBL feeds suggests potential misuse or compromise. While the subnet shows low abuse density, the specific endpoint warrants blocking at perimeter defenses. Monitor for related IPs in the 5.196.190.0/24 range.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.