145.224.111.58📋 Copy

IP INTELLIGENCE BRIEFING: 145.224.111.58/32

Classification: Low Risk - Legitimate Starlink Infrastructure

Executive Summary

IP 145.224.111.58 is a legitimate Starlink user endpoint associated with SpaceX (ASN 14593). The IP presents a low risk profile (score: 25/100) with no active threat indicators. The address resolves to Starlink customer infrastructure with DNS records pointing to the Starlink ISP domain. No open ports or active services were detected.

Infrastructure Profile

• Ownership: SpaceX / Space Exploration Technologies Corp (ASN 14593)
• Netname: STARLINK_1063372431940157539_WRSWPOL1_IPV4
• Organization: mnt-us-spacex-1
• RIR Registration: RIPE
• Geolocation: Kyiv, Ukraine (UA)
• CIDR Block: 145.224.111.0/24
• DNS PTR: customer.wrswpol1.isp.starlink.com
• Forward Resolution: customer.wrswpol1.isp.starlink.com (confirmed: false)

Threat Assessment

• Risk Score: 25 (Low Risk)
• Abuse Confidence: Not flagged as known attacker, spam source, or Tor exit node
• Blacklist Status: 0 blacklist hits, 1 DNSBL listing
• Threat Indicators: None detected
• Campaign Affiliation: No known campaign matches
• Network Role: Firewalled / No Services
• Classification: Not CDN, VPN, proxy, hosting, mobile, or residential

Service Analysis

• Open Ports: None detected
• TLS Certificate: None
• HTTP Title: None
• Server Banner: None
• Services: No active services identified

Temporal Analysis

• Observation Count: 19 signals observed
• Ownership Changes: 0 (stable ownership)
• Threat Persistence: 0 days
• Persistent Malicious Activity: False
• Route Stability: Unstable (route changes detected)

Subnet Neighborhood Analysis

• Subnet: 145.224.111.0/24
• Abuse Density: 0.0 (clean)
• Total Siblings: 4
• Active Siblings: 1
• Threat Siblings: 0
• Neighbor Risk Distribution: 0 high, 0 medium, 3 low
• Neighbor IPs:

- 145.224.111.44 (Risk: 25)

- 145.224.111.185 (Risk: 0)

- 145.224.111.191 (Risk: 0)

Relationship Graph

• Network Associations: Multiple relationships to STARLINK network block
• DNS Associations: customer.wrswpol1.isp.starlink.com (multiple references)

Observation History Highlights

Recent observations show geolocation signals indicating Ukraine (UA) with multi-signal inference confidence at 0.28. Some historical signals detected ASN 14593 with threat indicators in AlienVault OTX. Network classification signals show inconsistent states across observations. No persistent malicious behavior detected.

Recommended Actions

• Block/Allow: Generally allow traffic; no immediate blocking required
• Monitoring: Monitor for changes in geolocation or service activation
• Threat Hunting: Consider correlating with other Starlink IPs in the 145.224.x.x range
• Firewall Rules: No specific firewall rules recommended; standard egress filtering applies

SOC Analyst Notes

This is legitimate Starlink infrastructure, not typically a threat actor endpoint. The IP is associated with user satellite terminals in Ukraine. While currently low-risk, monitor for:

• Service activation on previously firewalled ports
• Changes in geolocation patterns
• Correlation with known threat activity from the subnet
• Route stability anomalies

Confidence Level: High - Profile data consistent with legitimate ISP infrastructure

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.