116.91.209.21📋 Copy

# IP Intelligence Briefing: 116.91.209.21

Classification: Moderate Risk — Network Infrastructure (Starlink)

Date: 2026-08-01

Analyst: IPDebrief Intelligence Team

---

## Executive Summary

IP address 116.91.209.21 is identified as a Starlink infrastructure endpoint located in Metro Manila, Philippines (ASN 14593, organization: SpaceX Services Inc administrator). The IP presents a moderate risk profile (score: 65/100) with no active threat indicators. The IP is firewalled with no open services detected. The /24 neighborhood shows low abuse density (14.3%), with only one of eight sibling IPs flagged as high risk.

---

## Network & Ownership Profile

• ASN: 14593 (SpaceX Services Inc administrator)
• Organization: SpaceX Services Inc administrator
• CIDR Block: 116.91.208.0/23
• Geolocation: Philippines (PH), Metro Manila, Manila
• Geolocation Consensus: False (source disagreement)
• DNS PTR: customer.mnlaphl1.isp.starlink.com
• DNS Domain: starlink.com
• Network Role: Firewalled / No Services

---

## Risk Assessment

---

## Neighborhood Analysis (116.91.209.0/24)

• Abuse Density: 0.143 (14.3%)
• Classification: Mostly clean
• Total Siblings: 8
• Active Siblings: 6
• Threat Siblings: 1

High-Risk Neighbor Detected: 116.91.209.103 (Risk Score: 80/100)

Medium-Risk Neighbors: 116.91.209.200, 116.91.209.215 (Risk Score: 55/100)

---

## Historical Signals (Last 24 Observations)

Recent observations show:

• Port scanning activity detected (timestamp: 2026-07-31T04:28:19)
• Transfer activity: 2 recent transfers, last transfer date 2024-07-26
• Geolocation inconsistencies: One observation routed through US Boston transit (ae7.cr2-bos1.ip4.gtt.net)
• Subnet abuse density: 0.125 (consistent with current neighborhood data)
• Threat observation count: 0
• Threat persistence days: 0

---

## Recommended Security Actions

Immediate Actions

1. Increase logging verbosity and review recent activity from this IP (Elevated risk score 65/100)

2. Implement firewall blocking if traffic does not match expected Starlink user patterns

Firewall Rules

• iptables: `iptables -A INPUT -s 116.91.209.21 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 116.91.209.21 drop`
• nginx: `deny 116.91.209.21;`
• pfSense: `116.91.209.21/32`
• Cloudflare WAF: Block IP with expression `ip.src eq 116.91.209.21`
• AWS WAF: Add address `116.91.209.21/32`

---

## Intelligence Notes

• The IP is part of the Starlink MNLAPHL1_PH network block, indicating satellite internet infrastructure
• No open ports or active services detected on this endpoint
• DNSSEC valid and CAA records present indicate proper DNS configuration
• One threat sibling (116.91.209.103) in the same /24 subnet warrants separate investigation
• Historical geolocation signals show routing through US transit, which may indicate legitimate traffic patterns or potential hijacking attempts

Recommendation: Monitor for sustained traffic patterns. If the IP shows no legitimate activity matching Starlink user profiles, consider blocking based on firewall rules provided.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.