148.227.91.29📋 Copy

# IP Intelligence Briefing: 148.227.91.29

## Executive Summary

Target IP 148.227.91.29 is a low-risk infrastructure address assigned to Starlink Brazil Serviços de Internet Ltd (ASN 14593). The IP is associated with the customer hostname customer.brsabra1.isp.starlink.com and is classified as "Firewalled / No Services." Current risk assessment indicates minimal threat activity, though the broader /24 subnet shows moderate abuse density.

## Ownership and Geolocation

## Risk Assessment

## Threat Indicators

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Known Campaigns: None identified
• Open Ports: None detected
• TLS Certificate: None
• HTTP Title: None

## Network Infrastructure

• Service Purpose: Firewalled / No Services
• Connection Type: Infrastructure
• Cloud Provider: No
• CDN: No
• VPNs/Proxies: No
• BGP Prefix: 148.227.88.0/22
• Route Stability: False
• RPKI State: Not assessed

## Subnet Neighborhood Analysis (148.227.91.0/24)

Risk Distribution Among Siblings:

• High Risk (40+): 7 IPs (148.227.91.58, 88, 123, 140, 163, 179, 248)
• Medium Risk (25-39): 4 IPs (148.227.91.30, 220, 224)
• Low Risk (<25): 8 IPs (including 148.227.91.29)

## Historical Observations

Observation Count: 16 signals recorded

Most Recent: 2026-07-26

Threat Persistence: 0 days

Persistent Malicious Activity: False

Recent activity includes port scanning signals and operator score assessments. No persistent malicious behavior detected over the observation period.

## DNS and Email Reputation

• PTR Hostname: customer.brsabra1.isp.starlink.com
• Forward Resolution: Confirmed (1 hostname)
• SPF Record: Present
• DMARC Record: Present
• Email Sender Score: Not assessed

## Recommended Actions

Based on the low-risk profile and Starlink infrastructure classification, the following actions are recommended:

1. Firewall Policy: Permissive rules may be acceptable for legitimate Starlink traffic.

2. Monitoring: Include IP in baseline traffic monitoring; no immediate blocking required.

3. Subnet Context: Monitor the /24 subnet for correlated activity from the 7 medium/high-risk siblings.

4. Threat Intelligence: No immediate threat indicators; continue passive monitoring.

## Conclusion

IP 148.227.91.29 presents as legitimate Starlink Brazil customer infrastructure with minimal current risk. The subnet shows moderate abuse density with several sibling IPs flagged as medium to high risk. SOC teams should monitor for any behavioral changes from the target IP or correlated activity from neighboring addresses in the 148.227.91.0/24 range.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.