145.224.94.141📋 Copy

# IP Intelligence Briefing: 145.224.94.141

Classification: Low Risk / Operational Infrastructure

Date: Intelligence compiled from current observations

Analysis Type: Defensive Security Assessment

---

## Executive Summary

IP address 145.224.94.141 is identified as operational Starlink satellite infrastructure with minimal threat indicators. The IP presents low-risk characteristics consistent with legitimate broadband service provider operations. No active malicious campaigns or attacker infrastructure patterns observed. SOC teams may monitor but no immediate blocking action required.

---

## Technical Profile

---

## Infrastructure Assessment

Service Status: The IP exhibits no open ports and no active services. Banner scanning confirmed firewall protection with no HTTP, SSH, or SMTP services accessible. TLS certificate scan returned null, indicating no publicly exposed services.

Network Role: The IP is classified as operational network infrastructure rather than edge-facing services. No CDN, VPN, proxy, or hosting characteristics detected.

Control Plane: Operator score of 0.2174 indicates minimal threat profile. RPKI state not validated. DNSSEC is valid. One DNSBL listing identified among eight total lists checked.

---

## Threat Intelligence

Active Threats: None detected. Threat indicators arrays empty. No known attacker signatures, spam source patterns, or Tor exit node characteristics.

Campaign Correlation: No campaign likelihood assigned. Zero certificate matches, zero banner matches, zero correlated IPs observed.

Historical Persistence: Single threat observation recorded. IP not classified as persistently malicious. Ownership changes: zero.

---

## Neighborhood Analysis

Subnet: 145.224.94.0/24

Abuse Density: 1 (low)

Classification: mostly_clean

Threat Siblings: 1 identified within subnet

Active Siblings: 0

The IP shares network infrastructure with minimal abuse density. One threat sibling present in the /24 subnet, but no active threat relationships detected for this specific endpoint.

---

## Relationship Graph

Twenty-eight relationship entities identified, primarily "Same Network" relationships to Starlink routing infrastructure (STARLINK_* identifiers). Relationships indicate integration within Starlink's broader network fabric rather than command-and-control or peer-to-peer connections.

---

## Observation History

Recent signal observations (2026-06-17 timeframe) show:

• Geolocation: Consistent Paris, France location with 750km accuracy radius. Geo-plausibility validated.
• Scanning Activity: Multiple port scans detected but no open services confirmed.
• Operator Classification: Minimal threat operator score maintained across observations.
• Abuse Density: Consistent "mostly_clean" subnet classification.

---

## Recommended Actions

Firewall/Blocking: No blocking required. IP presents legitimate broadband service provider characteristics.

Monitoring: Standard traffic monitoring appropriate. No elevated threat indicators warrant special attention.

Positive Identification: The PTR record (customer.mlnnita1.isp.starlink.com) and starlink.com domain resolution confirm legitimate Starlink infrastructure.

---

## SOC Analyst Notes

This IP address represents normal Starlink satellite internet infrastructure operations. The absence of open services and the Starlink PTR hostname confirm this is a legitimate service endpoint rather than malicious infrastructure. While the subnet contains one threat sibling, this specific IP shows no threat activity. Routine monitoring sufficient; no immediate defensive actions recommended.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.