148.227.91.186📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 148.227.91.186/32

Report Date: 2026-07-31

Classification: High Risk (Score: 80/100)

---

## EXECUTIVE SUMMARY

IP address 148.227.91.186 is associated with Starlink Brazil infrastructure (ASN 14593) and geolocated to Brasília, Brazil. While the IP carries a high risk score (80), current threat indicators are absent, with no active campaigns, blacklists, or malicious reputation sources identified. The address resolves to a Starlink customer hostname and reports as having no active services.

---

## OWNERSHIP & GEOLOCATION

DNS Resolution: customer.brsabra1.isp.starlink.com (forward confirmed, PTR verified)

---

## THREAT ASSESSMENT

Current Risk Profile:

• Risk Score: 80
• Provider Score: 0
• Authority Score: 0
• Abuse Confidence: Not scored
• Blacklist Count: 0
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No

Network Role: Provider/Infrastructure (Firewalled / No Services)

Open Ports: None detected

HTTP/TLS Services: None detected

Control Plane Indicators:

• Route Stability: False (isRouteStable: false)
• DNSBL Listed: 4 of 8 total lists
• RPKI State: Unavailable
• IRR Consistency: Unavailable

---

## OBSERVATION HISTORY

Signal Count: 14 observations recorded

Latest Observation: 2026-07-31T04:31:33 UTC

Temporal Analysis:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Is Persistently Malicious: False
• Threat Observation Count: 0

Recent Signal Types:

• Geo Location (Confidence: 0.70)
• Control Plane/Operator Score (Confidence: 0.60) - Operator Score: 0.2174 (Minimal)
• Ownership Status (Confidence: 0.85)
• ICMP/Geo Validation (Confidence: 0.50) - ICMP blocked

---

## NETWORK RELATIONSHIPS

Total Relationships: 6

• Same Network (×3): 148.227.91.0 - 148.227.91.255
• DNS Association (×3): customer.brsabra1.isp.starlink.com

No certificate matches, correlated IPs, or campaign associations detected.

---

## SUBNET NEIGHBORHOOD ANALYSIS

Subnet: 148.227.91.0/24

Total Siblings: 20

Abuse Density: 0

Risk Distribution:

• High Risk: 0
• Medium Risk: 8
• Low Risk: 11

Notable Neighbors:

---

## RECOMMENDATIONS

Firewall/Blocking:

Given the high risk score (80) despite clean threat indicators, apply monitoring-level blocking:

• iptables: `-A INPUT -s 148.227.91.0/24 -j LOG --log-prefix "STARLINK-`
• nftables: `inet starlink { tcp dport 80,443 ip saddr 148.227.91.0/24 counter drop; }`
• Cloudflare WAF: Block IP range with monitor mode enabled

Investigation Triggers:

• Monitor for changes in DNS resolution patterns
• Watch for emergence of open ports or service banners
• Alert on any new blacklist associations
• Track subnet-level abuse density changes

Contextual Notes:

This IP belongs to Starlink's Brazilian infrastructure. High risk scores on provider IPs may result from automated scoring anomalies, route instability, or DNSBL listings from unrelated sources. Correlate with known Starlink abuse patterns before taking blocking action.

---

Sources: IPDebrief Intelligence Platform

Confidence Level: Medium (Score 80 requires contextual validation)

Classification: SOC Analyst Actionable

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.