138.84.37.240📋 Copy

# INTELLIGENCE BRIEFING

IP Address: 138.84.37.240/32

Classification: Moderate Risk

Date: 2026-07-30

---

## Executive Summary

The target IP address 138.84.37.240/32 is associated with SpaceX Services, Inc. (ASN 14593) within the 138.84.37.0/24 subnet. The IP presents a moderate risk profile (55/100) primarily driven by DNSBL listings and control plane instability. No active threat indicators were detected. The IP resolves to Starlink infrastructure hostname with geolocation data showing provider consensus discrepancies.

---

## Ownership and Network Context

---

## Risk Assessment

Overall Risk Score: 55/100 (Moderate)

Risk Factors:

• Three DNSBL listings identified across eight total blacklist feeds
• Control plane shows route instability (isRouteStable: false)
• Operator score: 0.2174 (Minimal)
• Geovalidation flagged as implausible with 1,000km accuracy radius

Mitigating Factors:

• No known attacker status
• No Tor exit node association
• No active threat campaigns correlated
• No open services detected (firewalled/no services)

---

## Neighborhood Analysis

The /24 subnet contains 28 sibling IPs with the following risk distribution:

• High Risk: 0 IPs
• Medium Risk: 16 IPs
• Low Risk: 12 IPs

Abuse Density: 0.0 (No subnet-wide abuse pattern)

Notable Siblings: 138.84.37.5, 138.84.37.203, 138.84.37.219 (Risk Score: 55)

---

## Observations and Temporal Analysis

Total Observations: 16 signals recorded

Recent Activity: Ownership and geolocation signals observed within the last observation window

Geolocation Discrepancies:

• Primary consensus: Santa Cruz de la Sierra, Chile (CL)
• Historical data indicated: Hawthorne, California, US
• Provider inconsistency suggests multi-region Starlink infrastructure

Campaign Correlation: None detected

---

## Technical Profile

• Service Status: Firewalled / No Services
• Open Ports: None detected
• TLS Certificate: Not present
• PTR Record: customer.limaper1.isp.starlink.com
• Email Authentication: SPF present, DMARC present
• BGP Prefix: 138.84.36.0/23
• Route Changes (30d): 0

---

## Recommended Security Actions

Priority: HIGH

Category: Monitoring

Recommended Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 138.84.37.240 -j DROP

# nftables

nft add rule inet filter input ip saddr 138.84.37.240 drop

# Cloudflare WAF

ip.src eq 138.84.37.240 —> block

# AWS WAF

Addresses: 138.84.37.240/32

Description: IPDebrief risk 55

```

Justification: Elevated risk score (55/100) warrants increased logging verbosity and activity review. No immediate threat indicators present.

---

## Intelligence Notes

This IP operates within SpaceX/Starlink infrastructure. The moderate risk score is attributable to DNSBL presence rather than confirmed malicious activity. Route instability may indicate dynamic infrastructure provisioning common in CDN/ISP environments. Continue monitoring for changes in geolocation data or the emergence of open services.

Status: Monitor (No immediate threat action required)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.