148.227.122.245📋 Copy

# IP Intelligence Briefing: 148.227.122.245/32

Classification: Moderate Risk | Date: Current Analysis

---

## Executive Summary

IP 148.227.122.245 is a residential endpoint associated with Starlink Brazil Serviços de Internet Ltd (ASN 14593), located in Brasília, Brazil. The IP carries a moderate risk score of 55/100 with no active threat indicators detected. The endpoint is currently firewalled with no open services. Neighborhood analysis indicates a 17.65% abuse density within the /24 subnet.

---

## Ownership & Infrastructure

---

## Geolocation Signals

Multiple geolocation signals were observed:

• Primary: Brasília, Federal District, Brazil (BR)
• Alternative: One signal indicated Mexico (AS22884 total play telecomunicaciones SA de CV, coordinates 19.0439, -98.1984)
• Confidence: Varies by source (0.28–0.75)
• Geo Consensus: True (Brazil)

Note: Conflicting geolocation signals suggest potential routing anomalies or multi-tenant infrastructure.

---

## Network Role & Services

• Connection Type: Firewalled / No Services
• Open Ports: None detected
• TLS Certificate: Not present
• HTTP Services: None
• Classification: Not cloud, CDN, VPN, proxy, Tor, or hosting provider
• Mobile Carrier: None detected

---

## DNS & Email Reputation

• PTR Record: customer.brsabra1.isp.starlink.com
• Forward Resolution: customer.brsabra1.isp.starlink.com (1 record)
• Email Authentication: SPF: Yes, DMARC: Yes
• TXT Records: 0
• DNSBL Status: Listed on 3 of 8 total lists
• Domain: starlink.com

---

## Threat Indicators

Control Plane Data:

• DNSSEC Valid: Yes
• CAA Records: Yes
• Route Stability: False
• Route Changes (30d): 0
• Operator Score: 0.2174 (Minimal)

---

## Neighborhood Analysis (148.227.122.0/24)

• Total Siblings: 17
• Active Siblings: 9
• Threat Siblings: 3
• Abuse Density: 0.1765 (17.65%)
• Classification: mostly_clean
• Inherited Risk: 7/100

Neighbor Risk Distribution:

• High Risk (40+): 0 IPs
• Medium Risk (15-39): 6 IPs
• Low Risk (<15): 9 IPs

---

## Observation History (17 Signals)

Recent observations include:

• 2026-07-29 12:28:29: Brazil geolocation (confidence 0.28)
• 2026-07-29 12:27:54: Network classification signals (confidence 0.30)
• 2026-07-29 12:27:15: Mexico ASN 22884 with threat indicators (confidence 0.75)
• 2026-07-29 12:26:44: Neighborhood abuse density 0.1765 (confidence 0.75)
• 2026-07-29 12:26:04: Brasília geolocation via MaxMind (confidence 0.70)

Temporal Data:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 0
• Persistently Malicious: No

---

## Recommended Security Actions

Priority: High

Monitoring Recommendations

• Increase logging verbosity for traffic from this IP
• Review recent activity patterns and connection attempts

Firewall Rules

| pfSense | `148.227.1

---

## Threat Assessment Summary

---

## SOC Analyst Notes

• Risk Level: Moderate — Elevated risk score without confirmed malicious activity suggests potential for opportunistic abuse rather than confirmed threat actor involvement.
• Action Priority: Monitor rather than block — Current data indicates no confirmed malicious activity; blocking may impact legitimate residential Starlink users.
• Investigation Focus: Review DNSBL listings for specific reasons; investigate conflicting geolocation signals (Brazil vs. Mexico); monitor neighborhood for correlated abuse patterns.

---

## Related IPs

Three sibling IPs in the same /24 subnet show elevated risk scores:

• 148.227.122.135 (Risk: 40/100)
• 148.227.122.56 (Risk: 40/100)
• 148.227.122.106 (Risk: 40/100)

---

End of Briefing

Source: IPDebrief Intelligence Platform

Generated: 2026-07-29

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.