138.84.37.219📋 Copy

# IP Intelligence Briefing: 138.84.37.219/32

## Executive Summary

IP address 138.84.37.219 is classified as Moderate Risk (55/100). This IP is associated with Starlink satellite internet infrastructure but exhibits routing complexity through Comcast backbone (ASN 14593). No active threat indicators or malicious campaigns were detected. The IP is currently firewalled with no open services.

## Network Profile

• Risk Score: 55/100 (Moderate Risk)
• Geolocation: Santa Cruz de la Sierra, Chile (CL)
• Origin ASN: 14593 (Comcast Cable Communications)
• BGP Prefix: 138.84.37.0/24
• Ownership: SpaceX Services, Inc. (Starlink residential infrastructure)
• Abuse Contact: starlink-admin@spacex.com
• DNS PTR: customer.limaper1.isp.starlink.com
• Forward DNS: starlink.com

## Threat Assessment

• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Blacklist Count: 3 DNSBL listings (out of 8 total lists)
• Campaign Likelihood: Not associated with known campaigns
• Threat Persistence: 0 days
• Reputation Sources: No known reputation sources flagged

## Service Analysis

• Open Ports: None detected
• Network Role: Firewalled / No Services
• TLS Certificate: None
• HTTP Services: None detected

## Neighborhood Analysis (138.84.37.0/24)

• Total Neighbors: 26 IPs
• Abuse Density: 0
• Risk Distribution:

- High Risk: 0

- Medium Risk: 10

- Low Risk: 10

• Neighbor Risk Range: 0–40 (no high-risk neighbors identified)

## Observation History

The IP has 15 historical observations recorded. Recent signals indicate:

• Ownership attribution to SpaceX Services, Inc.
• ARIN registry registration
• Location data pointing to Hawthorne, US (Starlink HQ region)
• DNSSEC valid with CAA records present

## Behavioral Indicators

• Honeypot Hits: 0
• Enumeration Strikes: 0
• WAF Violations: 0
• Route Stability: False (routing changes observed)
• MoAS: No

## Recommended Security Actions

Based on the moderate risk score (55/100), the following actions are recommended:

Immediate Actions

1. Increase logging verbosity for traffic from this IP

2. Review recent activity to confirm legitimate use patterns

Firewall Rules

```bash

# iptables

iptables -A INPUT -s 138.84.37.219 -j DROP

# nftables

nft add rule inet filter input ip saddr 138.84.37.219 drop

# pfSense

138.84.37.219/32

```

WAF Configuration

• Cloudflare WAF: Block IP (expression: ip.src eq 138.84.37.219)
• AWS WAF: Add 138.84.37.219/32 to block list

## Intelligence Assessment

This IP represents a Starlink residential connection routed through Comcast infrastructure. The moderate risk score correlates with the 3 DNSBL listings and the general residential hosting nature. No evidence of active malicious activity, command-and-control, or scanning behavior. The neighborhood analysis shows low-to-medium risk density with no high-risk peers.

Recommendation: Monitor with elevated logging but no immediate blocking required unless additional threat intelligence emerges. The IP's Starlink origin suggests consumer residential use rather than infrastructure abuse.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.